×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
richa
Observer
Member since: ‎02-16-2024
‎02-27-2024
Community Statistics
Posts 5
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎02-16-2024
View All

Re: Monitoring log sources that goes silent?

by in Monitoring Splunk
‎02-27-2024 06:25 AM
‎02-27-2024 06:25 AM
Hi, Can you help? ... View more

Re: Monitoring log sources that goes silent?

by in Monitoring Splunk
‎02-27-2024 12:45 AM
‎02-27-2024 12:45 AM
Hi, I checked the solution. Seems like there are still issues with this solution. As it will not show event logs generated 24 hours back but it is showing daily events which were generated 48 hours back. Eg: if i check it today, it will not show logs sources generated on 26-feb but it will show logs sources generated on 25 feb date.  ... View more

Re: Monitoring log sources that goes silent?

by in Monitoring Splunk
‎02-16-2024 02:16 AM
‎02-16-2024 02:16 AM
Hi @scelikok,   Thanks for the query. This query is not giving any info about the index. Can index field be added as well while displaying the results. Also,  there are certain source log files which are created daily based on date. So, how will that be taken into account? ... View more

Re: Monitoring log sources that goes silent?

by in Monitoring Splunk
‎02-16-2024 01:49 AM
‎02-16-2024 01:49 AM
Hi @gcusello, Thanks for the query. But I would like to have it on sources and not source type as certain source types can have few log sources configured in it. Also, one more thing i would like to add, there are few log files which are created daily based on date. And if we configure the alert on log sources then those log sources will come as alert in the search query for not receiving logs as daily new files are generated. so, how to cater to that scenario? ... View more

Monitoring log sources that goes silent?

by in Monitoring Splunk
‎02-16-2024 01:17 AM
‎02-16-2024 01:17 AM
Hi. I'm looking for a query/solution that will alert me when a log source is no longer sending logs. We have 4 indexes to monitor with a lot of log sources. So, having the log sources in input lookup would not be a good idea as it would have to be maintained every time new log source is added. Thus, i am looking for a query which alerts me if any of the log sources currently configured in any of the 4 indexes goes silent for 24 hours. Would prefer not to have lookup command in the query as file would have to be maintained in that scenario. Need to run this query on all the currently configured log sources. Thank you. ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎02-27-2024 12:58 PM