All Apps and Add-ons

How to report on how many deployed hosts are actually forwarding data, and if not, report when they last sent data?

cbright
Explorer

For instance I have 1400 forwarders with the Windows TA app deployed but am trying to find which ones are not reporting at all and how many stopped reporting in the last few days.

wrangler2x
Motivator

I use this search to check my forwarders every day.

index="summary_forwarders" NOT sourceHost="127.0.0.1" | stats count by sourceHost sourceIp connectionType version build lastConnected  | eval lastConnected=strftime(lastConnected,"%m/%d/%Y %H:%M:%S") | fields sourceHost sourceIp connectionType version build lastConnected | dedup 1 sourceHost sortby -lastConnected | eval sourceHost=lower(sourceHost) | sort sourceHost

I always make a note of the count. If in a subsequent day I see a lower count, I know something has gone missing.

0 Karma

raja8220
New Member

I dont have the summary_forwarders index ?

0 Karma

dflodstrom
Builder

Good question! Relying on the forwarder management dashboards isn't practical.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...