Hi,
I'm looking for options to validate that a UFW is running on servers, without actually logging into the server (we are losing ssh access to all servers). Any recommendations?
Hi
You can schedule below query on your search head. I am assuming that Splunk UF is sending splunk internal logs to your indexers, in this case below query will search hosts from splunk internal indexes and it will produce output if Splunk UF didn't sent data since more than 15 minutes.
| metadata type=hosts index=_* | eval Lag=(now()-recentTime) | eval LastTime=strftime(lastTime,"%d/%m/%y %H:%M") | eval RecentTime=strftime(recentTime,"%d/%m/%y %H:%M") | rename host as Hostname | fields Hostname RecentTime LastTime Lag | where Lag > 900 | rename Lag As Lag(Seconds)
I am running this query once in a day and searching last 7 days data but you can schedule based on your requirement.
I hope this helps.
Thanks,
Harshil
I am a fan of this one since the metadata
command does what you want without the load required for pulling events like a traditional search to _internal
. I would tweak the search a little so it's a little easier to read/manage (in my opinion):
| metadata type=hosts ( index=_* OR index=* )
| eval Lag = ( now() - recentTime )
| where Lag > 900
| fields host RecentTime LastTime Lag
| convert ctime(*Time)
| rename host AS Hostname, Lag As Lag(Seconds)
The differences I made are:
where
command earlier to reduce the results set we have to work onconvert
command simplifies the string formatting of the epoch timesrenames
and convert
(pretty print) for the endEssentially, the same brilliant idea that @harsmarvania57 proposed. Just tweaked with my OCD.
Hi a212830,
on search head run the following search
index=_internal host=your_host
If you have results, Forwarder is active and alive.
If not there are two choices: stopped forwarder or connection problems, anyway there's a problem to debug.
Bye.
Giuseppe