- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to monitor servers using splunk
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to monitor servers using splunk
I have been tasked with figuring out how to monitor server activity using splunk and create alerts
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For example, let's say that we have 10 servers that all run the same code. The traffic is load balanced and the code performs a process, that either completes successfully. At the end of the process there is a flag that is set such as "Successful = yes or no". There is also a couple of identifiers such as the vendor ie. "ABC Company" and then there is a unique "Process ID". This process is called real time 24/7. What I am looking for is an alert that will alert me (and others) when a certain threshold has been exceeded. For example, for ABC Company if the Successful = no count < 5 during a certain time period then no alert, but as soon as it goes over 5, then I am alerted.
I hope that this helped.
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First step is to collect the relevant data from the logs (I assume). The moment you have the data, you can work on the alerts.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That information is already being collected
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
maybe this video about creating alerts will help https://www.youtube.com/watch?annotation_id=annotation_2942967387&feature=iv&src_vid=SuARLqm7_jc&v=0...
Dave
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you provide more details on what you mean by "server activity"?
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
