Check out the dbx health > Input metrics dashboard in DBX3.
http://docs.splunk.com/Documentation/DBX/3.0.2/DeployDBX/Monitordatabaseconnectionhealth
This one is very useful >> index=_internal sourcetype = dbx_job_metrics | table connection, name, record_read_success_count, status, start_time, end_time, duration
if you are using an older version, see appropriate docs, but the idea would be the same.https://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Troubleshooting
Regardless of the version, check the _internal sourcetype for appropriate logging to determine all is well, then use something like meta woot which has this beauty tstats search | tstats count min(_time) as firstTime, max(_time) as lastTime, max(_indextime) as recentTime where _index_earliest=-10m@m _index_latest=-5m@m by host, sourcetype, index
| eval host=lower(host)
| eval _time=now()-300 to check for event trend and alert on no/low events counts or, to calculate last indexed event time compared to now...and if that time creeps too long...alert...
https://splunkbase.splunk.com/app/2949/
Once you get the search that gives you the indicator you trust, save it as an alert:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Alert/Aboutalerts
... View more
