If you don't have data, you don't know anything
That's trying to prove a negative
Are you correlating multiple source feeds for prod? (eg network traffic, app logs, network monitoring, etc)
You need to figure out what your thresholds are for nonprod
Some places, they're [effectively] identical
Others…not getting data for more than a few days could be the first sign of an issue
March 11, 2020 at 04:40PM
via reddit https://www.reddit.com/r/Splunk/comments/fgrkms/how_can_i_monitor_qa_or_nonprod_or_preprod/fk8n6pb?utm_source=ifttt