Splunk Search

How to detect when a server has stopped indexing logs in Splunk?

pandeyashish
New Member

I need to know what server(s) has stopped ingesting logs OR for which server the logs are not ingesting into Splunk.

Thanks,

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this assuming that if no data is coming to splunk in 24 hrs(86400 sec) is your threshold.

| metadata type=hosts index=* | eval age=now()-recentTime | where age>86400

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

What version of Splunk are you running? If it's version 6.3 you could use the DMC, if your a version lower than 6.3 then you could use this search and set up an alert

     index=_internal sourcetype=splunkd destPort!="-"
     | stats sparkline count by hostname, sourceHost, host, destPort, version 
     | rename destPort as "Destination Port" 
     | rename host as "Indexer" 
     | rename sourceHost as "Forwarder IP" 
     | rename version as "Splunk Forwarder Version" 
     | rename hostname as "Forwarder Host Name" 
     | rename sparkline as "Traffic Frequency" 
     | sort - count
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this assuming that if no data is coming to splunk in 24 hrs(86400 sec) is your threshold.

| metadata type=hosts index=* | eval age=now()-recentTime | where age>86400
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...