Alerting

How to set alert when database inputs is not working?

karthi2809
Contributor

In database inputs i created one data inputs and set query and rising coloumn as time and i am getting result from database .some times the data inputs is not working .so how to set manual alert when data inputs is not working

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you're indexing your dbx logs (dbx.log for DB Connect v1, dbx2.log for DB Connect v2, not sure about v3), you should be able to find logs pertaining to your data input (definition loaded, execution started/finished events). Based on frequency of your input and average execution time, you can setup appropriate alert when you don't see a finished event.

0 Karma

mattymo
Splunk Employee
Splunk Employee

Check out the dbx health > Input metrics dashboard in DBX3.

http://docs.splunk.com/Documentation/DBX/3.0.2/DeployDBX/Monitordatabaseconnectionhealth

This one is very useful >> index=_internal sourcetype = dbx_job_metrics | table connection, name, record_read_success_count, status, start_time, end_time, duration

if you are using an older version, see appropriate docs, but the idea would be the same.https://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Troubleshooting

Regardless of the version, check the _internal sourcetype for appropriate logging to determine all is well, then use something like meta woot which has this beauty tstats search | tstats count min(_time) as firstTime, max(_time) as lastTime, max(_indextime) as recentTime where _index_earliest=-10m@m _index_latest=-5m@m by host, sourcetype, index
| eval host=lower(host)
| eval _time=now()-300
to check for event trend and alert on no/low events counts or, to calculate last indexed event time compared to now...and if that time creeps too long...alert...

https://splunkbase.splunk.com/app/2949/

Once you get the search that gives you the indicator you trust, save it as an alert:

https://docs.splunk.com/Documentation/Splunk/6.5.2/Alert/Aboutalerts

- MattyMo

adonio
Ultra Champion

do you see any errors in index = _internal when the input is not working?
some fast and dirty way to alert on it is just run the search index = | stats count | bin span= _time
set an alert if count = 0

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...