Hi All,
Is there a way for Splunk to send out an email notification when Splunk is not receiving any syslog entries from an application server or a network device?
Thanks.
Yes, although you need to define some criteria. For example -
Search for hosts that have sent syslog events in the past week, but have not sent syslog events in the past hour.
Here is a search that would work:
sourcetype=*syslog* earliest=-7d
| fields host
| eval hcount = if (_time>=relative_time(now(),"-1h"),1,0)
| stats sum(hcount) as hourlyCount count as weeklyCount by host
| where hourlyCount == 0
You could then schedule this to run every hour and alert if number of events is greater than zero.
Yes, although you need to define some criteria. For example -
Search for hosts that have sent syslog events in the past week, but have not sent syslog events in the past hour.
Here is a search that would work:
sourcetype=*syslog* earliest=-7d
| fields host
| eval hcount = if (_time>=relative_time(now(),"-1h"),1,0)
| stats sum(hcount) as hourlyCount count as weeklyCount by host
| where hourlyCount == 0
You could then schedule this to run every hour and alert if number of events is greater than zero.
thanks again for your help Iguinn!!
Sorry, it's a typo. I've updated my original answer to fix it! Thanks for commenting and sorry about that.
Hi Iguinn,
I tried to run your command and it gives me the error:-
Error in 'eval' command: The arguments to the 'relative_time' function are invalid.
May I know how do i fix that?
I'm very sorry, I'm kinda weak in programming.