I would like to be able to create an alert that will notify us if Splunk either 1)stops getting log data from a host or 2)gets more the x number of errors in a specified period.
I know that I can write a search/alert for each host however I would like to have one search/alert that monitors all hosts and pulls out the one host that is having issues.
Is this possible?
Thanks.
Yes, you can do something like this:
err* OR warn* OR fatal | stats count by host | where count > YourErrorThreshold
Then schedule the alert to run periodically over your evaluation timespan (e.g. every 5 minutes for the last 5 minutes) and set the alert to trigger on "number of events > 0"