How do I alert when a host stops sending data?

Question

What's the best way to create a search to identify which hosts have not sent a syslog message to Splunk in the last 2 days?

Accepted Answer

2

Are you talking specifically sourcetype=syslog or just any events from a host? It's easy to do any events from a host with something like this:

| metadata index=main type=hosts | eval age = now()-lastTime | where age > (2*86400) | sort age d | convert ctime(lastTime) | fields age,host,lastTime

Does that work for you?

link

answered 01 Jun '10, 22:25

Lowell ♦
11.2k●9●12●91
accept rate: 41%

Answer 2

0	I tried this search an got 0 search results link answered 17 Jun '10, 18:33 ram.malhotra 1●1 accept rate: 0% 1 this could mean that you don't have any "lost" hosts (18 Jun '10, 06:37) CerielTjuh

How do I alert when a host stops sending data?

Follow this question

Splunk Resources

Related questions