Getting Data In

Missing sourcetype from a particular device

surekhasplunk
Communicator

I have a list of 10 sourcetypes and a list of 14 ips . If a particular ip stops sending data for any sourcetype in last 6 hours i should be alerted. How to set it.
I tried metadata sourcetype but that gives only missing sourcetypes.
If i use only metadata host i get only missing hosts
but how to get a combination of missing host and sourcetype.

Tags (2)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

Use metasearch, replace SOURCETYPEs and HOSTs in below query and check.

| metasearch index=INDEXNAME
| stats count by sourcetype, host 
| append 
    [| makeresults 
    | eval sourcetype=split("SOURCETYPE1,SOURCETYPE2,SOURCETYPE3,...,SOURCETYPE10", ","), host=split("HOST1,HOST2,HOST3,....,HOST14", ",") 
    | mvexpand sourcetype 
    | mvexpand host 
    | fields - _time] 
| fillnull value=0 
| stats sum(count) as count by sourcetype, host 
| where count=0

And set Trigger Condition as Number of result greater than 0 in alert configuration.

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

Use metasearch, replace SOURCETYPEs and HOSTs in below query and check.

| metasearch index=INDEXNAME
| stats count by sourcetype, host 
| append 
    [| makeresults 
    | eval sourcetype=split("SOURCETYPE1,SOURCETYPE2,SOURCETYPE3,...,SOURCETYPE10", ","), host=split("HOST1,HOST2,HOST3,....,HOST14", ",") 
    | mvexpand sourcetype 
    | mvexpand host 
    | fields - _time] 
| fillnull value=0 
| stats sum(count) as count by sourcetype, host 
| where count=0

And set Trigger Condition as Number of result greater than 0 in alert configuration.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...