Alerting

Email alert when a data source don't sends events to splunk

andreaf83
Engager

Is possible in splunk to configure no data alert? I want to receive an email alert when, for any reason, a data source don't sends events to my splunk server for a specified time.

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Yes, provided you can write a search that is specific enough to your data source. See:

http://answers.splunk.com/questions/8764/monitoring-file/8765#8765

0 Karma

ftk
Motivator

The following search looks at all hosts in a given index and returns the ones that have not sent any data in the past 10 minutes (1200 seconds):

| metadata type=hosts index=blah |  convert ctime(recentTime) as Recent_Time | where lastTime < (now() - 1200) 

You could customize the 1200 to the interval of your choice, then schedule this search and set an alert condition, for example Number of results > 1 (which would fire when there are any hosts that haven't checked in in 1200 seconds).

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...