Just like that and you are one step closer to better monitoring of your data!
Broken Hosts App
Once installed, you can head over to the Broken Hosts App, where you are presented with your very own Broken Hosts dashboard. This dashboard contains four main parts:
- Broken Hosts–Hosts that have not sent data to Splunk for too long
- Future Hosts–Hosts that have data from the future
- Broken Hosts Event Types–Eventtypes used by the Broken Hosts app
- Lookup Suppressed Items–Items suppressed by the Broken Hosts Lookup
In this post, we will mainly be taking a look at the “Broken Hosts” panel, which will give us a breakdown of the current hosts that are, well, broken. This basically means that the host has failed to send in some type of data within a configured amount of time.
In the picture below we can see multiple entries for the host WIN-AT43IJOE0PM failing to send in different types of wineventlog and perfmon events: