Hi,
I have few sourcetypes which sometimes stops sending the data because of some indexer issues. Each hosts send data to multiple sourcetypes and I want to get an alert when any of the hosts stops sending the data for a particular sourcetype. I saw some old posts related to this but they don't exactly fit to my requirement.
Also in the email alert, I need to see which host is missing data from which sourcetype??
↧