Alerting

Alert if any forwarder stops sending

au_chrismor
Path Finder

I want to extend the ideas for "Send an alert if machine x" stops sending data, and build the "A forwarder has gone away" alert

How can I write an alert that tells me if we have received no data from an individual machine, without having to specify the machine. I've successfully used the answers here for single machines, but I want to make it universal, and not have to either change the search or add a new one every time I start to monitor a new machine.

The problem is that all the answers I have found here (admittedly, there may be some I missed) need you to identify the machine. What I want to use for example is the absence of Windows Security Log events to find that a Windows Forwarder has dropped off, similarly Syslog on my Solaris machines, but without naming the host.

Any suggestions?

Tags (3)
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Try the Splunk Deployment Monitor App, it has built in Forwarder Monitoring and Alerting :

  • Missing Forwarder(s)
  • Quiet Forwarder(s)
  • Forwarder(s) Sending Less Than Expected
  • Forwarder(s) Sending More Than Expected

View solution in original post

Damien_Dallimor
Ultra Champion

Try the Splunk Deployment Monitor App, it has built in Forwarder Monitoring and Alerting :

  • Missing Forwarder(s)
  • Quiet Forwarder(s)
  • Forwarder(s) Sending Less Than Expected
  • Forwarder(s) Sending More Than Expected

au_chrismor
Path Finder

Thanks Damien.

I found the answer in DM just as your reply came in... Appreciate it

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...