Splunk Enterprise

Monitor Splunks Internal Processes and Log Ingestion

celdridge1988
Engager

Hi All,

Currently running a distributed instance of Splunk on prem. Is there a way to monitor splunk manually through search rather than the DMC? The reason is because i would like to alert teams of faults (like an indexer not being seen by a cluster master etc.). I've also had an issue where we've not noticed where a data source has stopped ingesting, has anyone been able to successfully implement a search to detect when a log source stops ingesting?

All ideas are welcome! Thank you in advance 🙂

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
The Monitoring Console is a search head so you can create your own alerts there, if you wish. Just search the logs for the error condition of interest and save it as an alert.
---
If this reply helps you, Karma would be appreciated.
0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...