Are my Collectors ingesting data
This query will help you determine and Alert when Collectors haven't ingested data for an hour. Notice that you must have Data Indexing enabled.
_index=sumologic_volume
| where _sourceCategory="collector_volume"
| parse regex "\"(?[^\"]*)\"\:\{\"sizeInBytes\"\:(?\d+),\"count\"\:(?\d+)\}" multi
| timeslice 1h | bytes/1024/1024/1024 as gbytes
| sum(gbytes) as gbytes by collector, _timeslice
| where gbytes < 0.00001
-
Try this:
_index=sumologic_volume
| where _sourceCategory="collector_volume"
| parse regex "\"(?<collector>[^\"]*)\"\:\{\"sizeInBytes\"\:(?<bytes>\d+),\"count\"\:(?<count>\d+)\}" multi
| timeslice 1h | bytes/1024/1024/1024 as gbytes
| sum(gbytes) as gbytes by collector, _timeslice
| where gbytes < 0.00001
Please sign in to leave a comment.
Comments
2 comments