Description

The Broken Hosts App for Splunk is a useful tool for monitoring data going into Splunk. It has the ability to alert when hosts stop sending data into Splunk, as well as inspect the last time the final combination of data was received by Splunk. If the arrival of the final log for the index/sourcetype/host combination is later than expected, the Broken Hosts App will send an alert. This allows for quick status detection of the hosts and fast issue resolution. The Broken Hosts App for Splunk is the app for monitoring missing data in Splunk. The app’s three main objectives include: 1. Alerting when data is missing from Splunk in order to determine the cause. 2. Utilizing saved searches to facilitate rapid detection of the missing data. 3. Creating dashboards for visualization to help with further investigations.