name: Monitor Unsuccessful Backups
id: b2178fed-592f-492b-b851-74161678aa56
version: 1
date: '2017-09-12'
author: David Dorsey, Splunk
type: Baseline
datamodel: []
description: This search is intended to give you a feel for how often backup failures
  happen in your environments.  Fluctuations in these numbers will allow you to determine
  when you should investigate.
search: '`netbackup` "An error occurred, failed to backup." | bucket _time span=1d
  | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE'
how_to_implement: To successfully implement this search you must be ingesting your
  backup logs.
known_false_positives: none
references: []
tags:
  analytic_story:
  - Monitor Backup Solution
  deployments:
  - Daily Cache Updates
  detections:
  - Unsuccessful Netbackup backups
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  security_domain: endpoint