Silent Log Source

[Sultan77]

Good day everyone.

I am trying to monitor the environment hosts whether if any stopped sending logs.

The challenge here to make through content management > correlation search.

So it can be scheduled every ex: 2 hours.

any idea?

[gcusello]

Hi @Sultan77 ,

you have two choices:

create a lookup (called e.g. perimeter.csv and containing at list only one field: "host") containing the list of hosts to monitor and run a search like the following:

| tstats count where index=* earliest=-2h latest=now BY host
| append [ | inputlookup perimeter.csv | eval count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

otherwise, if you don't want to create and manage the lookup, you could check if an host sent logs e.g. in the last 30 days but not in the last 2 hours:

| tstats count latest(_time) AS _time where index=* earliest=-30d latest=now BY host
| where _time<(now()-7200

the second search requires less maintenance but gives you less control.

Ciao.

Giuseppe

[Sultan77]

looks nice, but how to do the correlation with it?

[gcusello]

Hi @Sultan77 ,

sorry, what do you mean with correlation with it?

Ciao.

Giuseppe

[ITWhisperer]

Splunk is not good at finding things which aren't there - normally you need to give it a list of what to expect and then check to see which of those are there. For example, you could create a list of hosts that are normally sending events to Splunk and count the events from those hosts over a period of time. Any hosts which don't have events may have stopped sending events.