I need to know what server(s) has stopped ingesting logs OR for which server the logs are not ingesting into Splunk.
Thanks,
Try this assuming that if no data is coming to splunk in 24 hrs(86400 sec) is your threshold.
| metadata type=hosts index=* | eval age=now()-recentTime | where age>86400
What version of Splunk are you running? If it's version 6.3 you could use the DMC, if your a version lower than 6.3 then you could use this search and set up an alert
index=_internal sourcetype=splunkd destPort!="-"
| stats sparkline count by hostname, sourceHost, host, destPort, version
| rename destPort as "Destination Port"
| rename host as "Indexer"
| rename sourceHost as "Forwarder IP"
| rename version as "Splunk Forwarder Version"
| rename hostname as "Forwarder Host Name"
| rename sparkline as "Traffic Frequency"
| sort - count
Try this assuming that if no data is coming to splunk in 24 hrs(86400 sec) is your threshold.
| metadata type=hosts index=* | eval age=now()-recentTime | where age>86400