Getting Data In

How to monitor deployed universal forwarders

joshk2005
Explorer

We sporadically have had issues where the forwarder service stops working due to the need to clear locks on the client. Is there a good search string that we could use to alert off of when specific forwarders stop working? We are specifically looking to ensure that our domain controllers do not stop forwarding data (for long) due to the forwarder service not running.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi joshk2005,

check out the deployment monitor app https://apps.splunk.com/app/1294/ which includes such searches like missing forwarder and other stuff which can be useful. Also check out the S.o.S app https://apps.splunk.com/app/748/ or if you're using Splunk 6.2 have a look at the http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole

cheers, MuS

trsavela
Path Finder

Deployment monitor app is a great tool. There is even built in options to create alerts easily - great time saver.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...