How to detect when a server has stopped indexing logs in Splunk?

[pandeyashish]

I need to know what server(s) has stopped ingesting logs OR for which server the logs are not ingesting into Splunk.

Thanks,

[skoelpin]

What version of Splunk are you running? If it's version 6.3 you could use the DMC, if your a version lower than 6.3 then you could use this search and set up an alert

     index=_internal sourcetype=splunkd destPort!="-"
     | stats sparkline count by hostname, sourceHost, host, destPort, version 
     | rename destPort as "Destination Port" 
     | rename host as "Indexer" 
     | rename sourceHost as "Forwarder IP" 
     | rename version as "Splunk Forwarder Version" 
     | rename hostname as "Forwarder Host Name" 
     | rename sparkline as "Traffic Frequency" 
     | sort - count

[somesoni2 · Accepted solution]

Try this assuming that if no data is coming to splunk in 24 hrs(86400 sec) is your threshold.

| metadata type=hosts index=* | eval age=now()-recentTime | where age>86400