Reporting

Index Not Reporting in Splunk Query

anandhalagaras1
Contributor

Hi Team,

I would like to create a saved search in such a way that if any of the index is not reporting in Splunk for more than an hour then it should trigger an email with the index name information in it along with the last event came from that index.

Is there any query available so that i can schedule the same.

Tags (1)
0 Karma

arjunpkishore5
Motivator

Try this.

| tstats latest(_time) as last_time, latest(_raw) as last_event by index earliest=-2h
| where (now()-last_time) > 3600

anandhalagaras1
Contributor

Hi arjunpkishore5,
Getting an error when i ran the query.
Error in 'tstats' command: Invalid argument: 'earliest=-2h'
The search job has failed due to an error. You may be able view the job in the Job Inspector.

Kindly check and let me know.

0 Karma

to4kawa
Ultra Champion
| metadata type=sourcetypes
| where recentTime <= relative_time(now(),"-1h")

Hi, @anandhalagarasan16021988
This query is aim to check sources has not been updated more than an hour.
you can change types(sources, hosts)

or

| tstats summariesonly=t  count where index=index1 OR index=index2 by index _time span=1h
| timechart cont=f count by index
| where _time <= relative_time(now(),"-1h")

This query also checks for an index that has not been updated.

0 Karma

anandhalagaras1
Contributor

Kindly help on the request.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...