Hi All,
Currently running a distributed instance of Splunk on prem. Is there a way to monitor splunk manually through search rather than the DMC? The reason is because i would like to alert teams of faults (like an indexer not being seen by a cluster master etc.). I've also had an issue where we've not noticed where a data source has stopped ingesting, has anyone been able to successfully implement a search to detect when a log source stops ingesting?
All ideas are welcome! Thank you in advance 🙂