I'm new working with Splunk and I want to create reports and email notification to me when any systems go down. Can any of you help me with any search string for that?
@ThelmaJ - There could be multiple ways to do that.
One way is if you are monitoring log files from the web application then you can do something like the below:
index=<your-index> sourcetype=<web-logs-sourcetype> | stats count by host | append [| inputlookup list_of_web_server_host_names.csv | eval count=0] | stats sum(count) as count by host | where count=0
You can run this alert every 15 minutes or 1 hour depending on the requirement.
If the host did not send any logs then you can get an alert.
This is one of the way, but depending on what setup you have there could be lot of ways you can achieve the same.
I hope this helps!!!