Index Not Reporting in Splunk Query


Hi Team,

I would like to create a saved search in such a way that if any of the index is not reporting in Splunk for more than an hour then it should trigger an email with the index name information in it along with the last event came from that index.

Is there any query available so that i can schedule the same.

Tags (1)
0 Karma


Try this.

| tstats latest(_time) as last_time, latest(_raw) as last_event by index earliest=-2h
| where (now()-last_time) > 3600


Hi arjunpkishore5,
Getting an error when i ran the query.
Error in 'tstats' command: Invalid argument: 'earliest=-2h'
The search job has failed due to an error. You may be able view the job in the Job Inspector.

Kindly check and let me know.

0 Karma

Ultra Champion
| metadata type=sourcetypes
| where recentTime <= relative_time(now(),"-1h")

Hi, @anandhalagarasan16021988
This query is aim to check sources has not been updated more than an hour.
you can change types(sources, hosts)


| tstats summariesonly=t  count where index=index1 OR index=index2 by index _time span=1h
| timechart cont=f count by index
| where _time <= relative_time(now(),"-1h")

This query also checks for an index that has not been updated.

0 Karma


Kindly help on the request.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...