Hi,
I would request a query where if a log source has stopped sending an event to splunk for a specific time period, it should alert me.
Example index=proxy sourcetype=test_5 not giving any result for last 15 mins.
index=*| stats count as event_count by sourcetype |append[|metadata type=sourcetypes index=* OR index=_*| eval event_count=coalesce(event_count, 0) | table sourcetype,event_count] | where event_count = 0
@staparia ,
index=proxy sourcetype=test_5 earliest=-15m|stats count|where count > 0
Set an alert for 'No of events is less than 0'
