Alerting

How to create alert for server / forwarder / index that doesn't work?

agentsofshield
Path Finder

In order to find out more quickly if a certain part of Splunk doesn't work, I figured that maybe there's a way to create an alert in case one of these things doesn't work?:

  • Server (if any server is down - search, indexer, deployment, etc.)
  • Forwarder
  • Index (I'd like to check on important indexes we use all the time)

I want an alert in case one of these doesn't work. Anyone knows how?

Cheers

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @agentsofshield ,

You could use monitoring console (Old DMC)for that. Please have a look at this http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Platformalerts
AND
http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Configureforwardermonitoring
AND
In general : http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Monitoringoverview

Please lets know in case you need further help

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Hi @agentsofshield ,

You could use monitoring console (Old DMC)for that. Please have a look at this http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Platformalerts
AND
http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Configureforwardermonitoring
AND
In general : http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Monitoringoverview

Please lets know in case you need further help

Happy Splunking!

agentsofshield
Path Finder

Ok thanks but here's another question:

Any way I can make these alerts pop on the search heads too? Currently it's only a triggered alert on the indexer master node.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust
0 Karma

agentsofshield
Path Finder

Ok, what about indexes? Can I check if an index brings back results and if it doesn't, create an alert?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...