问缺少转发器警报

EN

DMC警报-缺少转发器警报无法正常工作。

我们提供了如下所示的查询，并从不同的主机服务器和不同的日期获得输出。我只想在Universal forwarder停止工作时发出警报。

| inputlookup dmc_forwarder_assets | makemv delim=“”avg_tcp_kbps_sparkline | eval sum_kb = if (状态== "missing"，"N/A"，sum_kb) | eval avg_tcp_kbps_sparkline = if (状态== "missing"，"N/A"，avg_tcp_kbps_sparkline) | eval avg_tcp_kbps = if (状态== "missing"，"N/A"，avg_tcp_kbps) | eval avg_tcp_eps = if (状态== "missing"，"N/A"，avg_tcp_eps) | eval forwarder_type = case(forwarder_type == "full"，"Heavy Forwarder"，forwarder_type == "uf"，"Universal Forwarder"，forwarder_type == "lwf"，"Light Forwarder"，1==1，forwarder_type) | search NOT | inputlookup dmc_assets | dedup "servername“|将"servername”重命名为主机名|字段主机名status=missing

预期结果:当splunk forwarder停止或发送日志失败时，收到警报。