icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Splunkbase will be undergoing a scheduled migration and will be unavailable on Saturday, Oct 1, 2022, from 11AM to 3PM PDT

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Broken Hosts App for Splunk
SHA256 checksum (broken-hosts-app-for-splunk_414.tgz) bae4e7073872989321d023afd1456afeb0e1bba81335e8cf518a4e967fd8087c SHA256 checksum (broken-hosts-app-for-splunk_413.tgz) 04a8b6d507b1f62f90dc2d9f74d8661de29d0272959a69e0746f1124ebecffa9 SHA256 checksum (broken-hosts-app-for-splunk_412.tgz) dc5bde27256ca2addd0bf176744770d656d440324d58ebfb6aa609b8f2b84d63 SHA256 checksum (broken-hosts-app-for-splunk_411.tgz) cafb06d5862264cee6c54b40246606f8d5689146b9112542860d5c9111f28d2b SHA256 checksum (broken-hosts-app-for-splunk_410.tgz) 91c43f505255d3a5b0d733d3badfd16aeb5e0eff60446777418d7c58738fd34f SHA256 checksum (broken-hosts-app-for-splunk_409.tgz) 79f247a532553e07665198c07a71806d5686c1b816c0426c333232ab90228c01 SHA256 checksum (broken-hosts-app-for-splunk_408.tgz) 99002dd3ac3d4ec789d01bddfa7dc799ce47ad04099c3e8a915fbfe24e50da87 SHA256 checksum (broken-hosts-app-for-splunk_406.tgz) a49b36dd3d1a96bce7b46b9633052ca6a477729dc3a3d326add74fcc5c3e7d56 SHA256 checksum (broken-hosts-app-for-splunk_405.tgz) 623d8649d0a7426c7f6d31f21811ac455965118387cd56b3b5d7273ffafab9c8 SHA256 checksum (broken-hosts-app-for-splunk_404.tgz) 7b6411a3b3ad4340c8cea785eabc03b650d321df413aa1d8eaee276450efbe96 SHA256 checksum (broken-hosts-app-for-splunk_403.tgz) 0c187554b407df3296b91c7d3e7ee9445494ea4b0f29e8e96945d111d6da0500 SHA256 checksum (broken-hosts-app-for-splunk_402.tgz) dd4f1b9509ca819c1b5af0400f504f0db76ed5fd1569bb9b39301f6687fb74d0 SHA256 checksum (broken-hosts-app-for-splunk_336.tgz) 1eca643de55a82110966fd88842e4e23124359e77f9c6d118a2f41dbdff45cf6 SHA256 checksum (broken-hosts-app-for-splunk_335.tgz) ce911baed727397ec88abc485df971e3cf74d2c0a5f64a646eaee6b3535c45f6 SHA256 checksum (broken-hosts-app-for-splunk_334.tgz) 77083b01de2e009ed3033ed4cadb75d9ec289715977e21c858cc66addc330686 SHA256 checksum (broken-hosts-app-for-splunk_332.tgz) a04c991a6d3315f0a09fbdff8a02ec06cdaccfdc195932204f02cec1e84df041 SHA256 checksum (broken-hosts-app-for-splunk_331.tgz) 2b9889580397288c251de1fcb078443a889a3ef5e8faf73a5bd0546eeaa36ebf SHA256 checksum (broken-hosts-app-for-splunk_320.tgz) f0bbcd26b56e560e477160c874ac19b11dfca9dab68f7c63fd6663464d3546c7 SHA256 checksum (broken-hosts-app-for-splunk_310.tgz) 3c7d3220532f499db16169fe7102e27ed2330fda2aad26a8e157abe91f6a302a
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Broken Hosts App for Splunk

Splunk Cloud
The Broken Hosts App for Splunk is a useful tool for monitoring data going into Splunk. It has the ability to alert when hosts stop sending data into Splunk, as well as inspect the last time the final combination of data was received by Splunk.

If the arrival of the final log for the index/sourcetype/host combination is later than expected, the Broken Hosts App will send an alert. This allows for quick status detection of the hosts and fast issue resolution.

The Broken Hosts App for Splunk is the app for monitoring missing data in Splunk. The app’s three main objectives include:
1. Alerting when data is missing from Splunk in order to determine the cause.
2. Utilizing saved searches to facilitate rapid detection of the missing data.
3. Creating dashboards for visualization to help with further investigations.

* Latest documentation can be found here:

Latest documentation can be found here:

Release Notes

Version 4.1.4
Aug. 31, 2022

- Fix app.manifest version number
- Fix bug in Configure Broken Hosts Lookup dashboard where dropdowns for index, sourcetype, and host were not populating
- Moved JS dependency into local appserver folder to fix AppInspect issue

Version 4.1.3
July 15, 2022

This update removes the default suppression of Splunk Cloud hosts to reflect changes made to Splunk inputs as part of the Victoria experience.

Version 4.1.2
Jan. 25, 2022

v 4.1.2
- app.manifest now includes:
"targetWorkloads": ["_search_heads"]
- outputlookup removed from configure_lookup.xml dashboard
- Removed all use of outputlookup command to meet Splunk Cloud requirements. Replaced with API requests.
- Bug fix on batch update - incorrect increment could cause limit to be hit when updating causing loss of data in KV
- Better error handling - shows errors in UI if failure to edit or delete

Version 4.1.1
Jan. 13, 2022
Version 4.1.0
Dec. 15, 2021

- Improvements to the 'Configure Broken Hosts Lookup' page
- Bug fix: when results hit over 1k entries, it hits the default 1k limit in limits.conf resulting in the kv store being emptied out. The results are now batched to prevent this issue.

Version 4.0.9
Sept. 20, 2021
  • Fix setup page not loading
Version 4.0.8
Sept. 17, 2021

Setup page added for app configuration.

Version 4.0.6
Sept. 7, 2021
  • Updated dashboards to XML version 1.1 for jQuery 3.5 compatibility
  • trigger stanza added to app.conf for bh.conf file
Version 4.0.5
June 19, 2020

The updates provided in 4.0.5 are:
- Python 3 support for Splunk 8.0.
- The app no longer has a setup.xml file to conform with Splunk Cloud's vetting process.

  • Since no setup.xml is allowed on cloud, all configuration is related to macros that come with this app. The following macros are available to configure:
  • default_contact
  • default_expected_time
  • ignore_after
  • linuxoslog_index
  • min_count
  • search_additions
  • wineventlog_index
Version 4.0.4
Dec. 12, 2018
  • updated bh_stats_gen search to fix a bug that might cause false positives
  • set eventtypes to be local to the app instead of global
Version 4.0.3
Dec. 10, 2018
  • updated AutoSort to allow for arbitrary fields
  • update investigation panel to show a timechart of splunk restarts
  • fixed type in app.conf that was preventing successful vetting
Version 4.0.2
Nov. 16, 2018
  • Fixed a bug with Google Chrome 70+
  • Revamped architecture
    -- Decouple stats generation from alert generation
    -- Eventtype-based aggregations and suppressions
  • Additional investigation dashboards
  • KV Store auto-sort functionality (enabled by default) to prevent false positive matches
Version 3.3.6
March 19, 2018

- Row reordering feature added to 'Configure Broken Hosts Lookup' page. Can drag rows using the 'Comments' column.
- 'Add New Suppression' button added to top right to make more visible.
- Ability to Copy formatted row data to clipboard
- Added expectedTime_tmp for backup purposes.
- In edge cases where KV Store is being updated after a row-reorder on Configure page and user refreshes, KV Store data could be lost. For this reason, every change made backs up the current version to a expectedTime_tmp KV Store first
- On initial load of the table it will check if expectedTime is empty, if it is it will then check expectedTime_tmp for data and use that as a backup in case the KV Store was emptied. If both are empty then it is assumed this is a new install and the user has an option to add default values to the KV Store.

Version 3.3.5
Jan. 4, 2018

- updated the savedsearch to account for sourcetype rewrites

Since kvstore doesn't allow reordering, use this process if a line needs to be moved:
1) go to the broken hosts search and run:
| inputlookup expectedTime | outputlookup expectedTime.csv
(this will populate the CSV with contents of the kvstore)
2) go to the lookup editor app:
- open the expectedTime.csv
- reorder the rows as necessary
- remove _key column
3) go to the splunk search window and run:
| inputlookup expectedTime.csv | outputlookup expectedTime

IMPORTANT: Update Instructions:
- v3.3.3 and greater uses a KV Store instead of a lookup file. Once the app is updated, you will need to populate the KV Store.
- This will only need to be done one time:
1. Run the following search which will dump all the results from the lookup into the KV Store:
| inputlookup expectedTime.csv | outputlookup expectedTime
2. Go to the new "Configure Broken Hosts Lookup" dashboard to check if data is populating on dashboard.

Version 3.3.4
Dec. 13, 2017

- Removed unnecessary inputs.conf

Version 3.3.2
Aug. 29, 2017


  • fixed a bug where the the broken hosts dashboard would show the wrong value for "Time Since Last Event"
  • updated the app to work if the app directory is renamed
  • updated the order of fields in the broken hosts dashboard
  • reordered default expectedTime lookup table to be alphabetical
  • added "cim_modactions" index to the default suppressions
  • added cisco:ios default suppression
  • added pan_config and pan:config default suppressions
Version 3.3.1
June 12, 2017


  • bug fixes for splunk certification
    -- scale icon sizes down to splunk approved sizes


  • updated savedsearch to include any hosts that are sending logs from the future
  • added the ability to add custom search additions to make the search more flexible
  • added dashboard panel to show suppressed items
  • updated dashboard panels to show currently broken items, and all items from the future
  • added sparkline to the dashboard panels
Version 3.2.0
Nov. 14, 2016

Modified the savedsearch to use 'tstats' instead of 'metadata' to allow use of sourcetype for tuning.

Updated the savedsearch schedule to run every 30 minutes (because tstats takes longer than metadata).

Updated the savedsearch suppression to suppress for 2 hours instead of 1.

Updated the savedsearch suppression to include sourcetype.

Updated expectedTime lookup table to add a 'sourcetype' column.

Updated first_time script to add 'sourcetype' column to lookup table.

Added Broken Hosts dashboard.

Updated documentation to include Broken Hosts dashboard information.

Added app nav color.

Version 3.1.0
July 29, 2016

- Added setup page with default contact and default allowable lateness

- Another major rewrite
- Added the ability to suppress an item
- Added the ability to send different items to different contacts

- fixed issue with the index exclusions in the search
- reversed the order of the release notes, putting new version at the top

- wildcard in lookup table instead of empty quoted string
- app is visible (to allow the "run" button on the saved search to work)
- initial lookup table is now named with .sample extention to not over-write any previous tuning

v2.0: complete re-write of the app from scratch
- uses dbinspect and metadata commands to make this search much faster
- uses a lookup table to make tuning a breeze

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.