Alerting

Alert for when new index/sourcetype is created

mr_t2083
Explorer

What’s a good search query I can use to notify me any time a new index or sourcetype is created with a 7 day range.

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

hello there,

partial answer here, indexes first.
here is how to check if an index was created, note: did not check in indexer cluster configuration but i assume its the same or close

index = _audit action=indexes_edit info=granted operation=create
| stats values(object) as new_index_created by _time splunk_server
| rename _time as creation_time splunk_server as indexer

as for sourcetype,
you can use the |metadata type=sourcetypes maybe with | outputslookup command to generate a lookup of sourcetype names and the last time they were seen by splunk and than have a search to run against new data and match to existing lookup table to see if there are any new sourcetypes

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

hello there,

partial answer here, indexes first.
here is how to check if an index was created, note: did not check in indexer cluster configuration but i assume its the same or close

index = _audit action=indexes_edit info=granted operation=create
| stats values(object) as new_index_created by _time splunk_server
| rename _time as creation_time splunk_server as indexer

as for sourcetype,
you can use the |metadata type=sourcetypes maybe with | outputslookup command to generate a lookup of sourcetype names and the last time they were seen by splunk and than have a search to run against new data and match to existing lookup table to see if there are any new sourcetypes

hope it helps

0 Karma

mr_t2083
Explorer

Hi Adonio,

Thanks for your response, but I'm looking for a way to identify when new data is added to splunk. For example lets say sourcefire data is added and a new index called index=sourcefire is created. How can I get an alert when something new is added to splunk?

0 Karma

adonio
Ultra Champion

please refer back to the answer, the search above tells you when a new index was configured.
for sourcetypes, you can use the I metadata type=sourcetype command.
try it and see the result. you can capture a new sourcetype by the first and last field values that this command genarates

0 Karma

p_gurav
Champion

you can use | rest /services/data/indexes

0 Karma

mr_t2083
Explorer

That just give me a list of index, I’m looking for a search that will give me a list of new index created in the last 7 days

0 Karma

aakwah
Builder

on the indexer run:

tail -f /opt/splunk/var/log/splunk/splunkd.log | grep index_name

then create and index and catch the log line, and you should find this log on _internal index

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...