Splunk Search

What alert search can I use to check and alert on a HF not forwarding any data.

JTS911
Explorer

Is there a heart beat from the HF I can monitor and if not detected, alert on it ? 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The Monitoring Console can do that for you.

There are a number of events you can use as a heartbeat.  Search the internal index for one your forwarder's names to find them.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

JTS911
Explorer

Used this to find the HF's 

| set diff [search earliest="-30m" index=_internal host="*-splunk-hf"
| dedup host
| table host] [search earliest="-10m" index=_internal host="*-splunk-hf"
| dedup host
| table host]

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Monitoring Console can do that for you.

There are a number of events you can use as a heartbeat.  Search the internal index for one your forwarder's names to find them.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...