Getting Data In

How to monitor deployed universal forwarders

joshk2005
Explorer

We sporadically have had issues where the forwarder service stops working due to the need to clear locks on the client. Is there a good search string that we could use to alert off of when specific forwarders stop working? We are specifically looking to ensure that our domain controllers do not stop forwarding data (for long) due to the forwarder service not running.

0 Karma

MuS
Legend

Hi joshk2005,

check out the deployment monitor app https://apps.splunk.com/app/1294/ which includes such searches like missing forwarder and other stuff which can be useful. Also check out the S.o.S app https://apps.splunk.com/app/748/ or if you're using Splunk 6.2 have a look at the http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole

cheers, MuS

trsavela
Path Finder

Deployment monitor app is a great tool. There is even built in options to create alerts easily - great time saver.

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...