Splunk Search

How to determine if the log is missing

xsstest
Communicator

there are many hosts in an indexer. How do I check if the log is missing?

If a host does not have a log Within an hour, I think it's a log loss

If a host log is lost, I need to find it and remind me.

How does the SPL statement write?

Tags (1)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Hi..
You can create an Alert for this task... and you can add an email notification.
The search query -

index=IndexName host=hostname.com source=/app/Java/1hr.log

and save this as an alert, and add an action for "Send email"
alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi..
You can create an Alert for this task... and you can add an email notification.
The search query -

index=IndexName host=hostname.com source=/app/Java/1hr.log

and save this as an alert, and add an action for "Send email"
alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

xsstest
Communicator

Do I need to set up an alert for each host?

0 Karma

inventsekar
SplunkTrust
SplunkTrust
  1. no need to setup for each host. you can get a list of all hosts that are not connected/sent events for last 1hr, 24hrs, etc.
  2. do you want alerts depending on host or depending on host plus the exact logfile?

The following search will alert you if there are any hosts that haven't sent any data for more than one hour (3600 seconds)

compare last event's time to now

 |metadata type=hosts | eval since=now()-lastTime | search since>3600 |...

OR
 # compare indexer's time when last event came to now
|metadata type=hosts | eval since=now()-recentTime| search since>3600 |...

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...