Reporting

Index retention report

Builder

All,

I am looking for a daily PDF report that verifies none of the dropped events are outside of my retention policy for that index and gives me warning if an indexer might be over tasked. Any idea how I would get that going?

0 Karma

Champion

Hi,

In splunk monitoring console you can set "Saturated event-processing queues" alert to checked if indexer might be over tasked.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!