Dashboards & Visualizations

Feeds , index dashboard

ecanmaster
Explorer

Is there a dashboard out here which can show the status of the indexes and feeds, health etc.?
I am looking particularly for feeds that don't come in on indexes or sourtypes, looking for thus for things that go wrong

Tags (1)
0 Karma

naidusadanala
Communicator
0 Karma

mayurr98
Super Champion

Then try this :

| tstats count where index=* by index sourcetype host | where count=0 

OR

index=* | stats count by index host | where count=0

Run this search for today And see which hosts are not sending data.
Keep the fields you want using | fields your_field Command
Let me know if this helps you

0 Karma

ecanmaster
Explorer

Unfortunatly, that's not what I need exaclty,

I need to know which index or source is inactive, offline (no data received) also need to know how many hosts are sending the data to the index/sourcetype , or even better which hosts are not sending data anymore to the index/sourcetype.

0 Karma

nikita_p
Contributor

Hi @ecanmaster,
You can also check status of your indexes in splunk monitoring console.
Also if you go to setting -> indexer clustering in your deployment server, you will get status of all your indexes.

Also you can check below splunk docs which explain what monitoring console can do.
https://docs.splunk.com/Documentation/Splunk/7.0.1/DMC/WhatcanDMCdo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...