Monitor Splunks Internal Processes and Log Ingestion

[celdridge1988]

Hi All,

Currently running a distributed instance of Splunk on prem. Is there a way to monitor splunk manually through search rather than the DMC? The reason is because i would like to alert teams of faults (like an indexer not being seen by a cluster master etc.). I've also had an issue where we've not noticed where a data source has stopped ingesting, has anyone been able to successfully implement a search to detect when a log source stops ingesting?

All ideas are welcome! Thank you in advance 🙂

[richgalloway]

The Monitoring Console is a search head so you can create your own alerts there, if you wish. Just search the logs for the error condition of interest and save it as an alert.

[gjanders]

Alerts for Splunk Admins might help here