Log sources not reporting

[sahildb]

Currently our index= windows host not reporting from last couple of days.

Need query to set up alert if log sources are not reporting to splunk.

[scelikok]

Hi @sahildb,

You can use below query to find hosts that is not reporting for 60 minutes by host, index and sourcetype.

| tstats max(_time) as _time where index=* by index host sourcetype | where _time < relative_time(now(),"-60m")

 You can adapt 60 minutes timeout and indexes to your need. 

[scelikok]

Hi @sahildb,

You can use Broken Hosts app to monitor your data ingestion problems,

https://splunkbase.splunk.com/app/3247/

[sahildb]

Is there any query we can use to detect ?

[sahildb]

Thanks for the solution i think will recommend the same to team.

[sahildb]

Need to verify and set up alert which index generate data and or not and how we can monitor