Splunk Search

Query for Splunkd Status

wvalente
Explorer

Hi Guys,

There's any query in the splunk web that I'm able to see if the splunkd is not running in a forwarder?

Tks.

Tags (1)
0 Karma

wvalente
Explorer

Tks @woodcock, @cusello and @niketnilay

I'll try this solutions.

0 Karma

woodcock
Esteemed Legend

I would use tstats like this:

| tstats count max(_indextime) AS _time WHERE index="_*" AND host="YourHostHere"

You can build an alert from there.

niketn
Legend

@wvalente, there could be several ways to identify this.

1) By _internal index has already been called out by Giuseppe. For remaining like:
2) metadata command
3) REST api with lastPhoneHomeTime

| rest /services/deployment/server/clients

(https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTdeploy#deployment.2Fserver.2Fclients)
4) Distributed Monitoring Console to monitor deployment status, which uses above REST API.

Refer to answer by @DalJeanis which compiles all these and more 🙂
https://answers.splunk.com/answers/525926/how-do-we-determine-whether-a-forwarder-phoned-hom.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi wvalente,
you can check if your forwarders are sending logs to Splunk, reasons for this situations could be many (splunkd not running, network problems, host down, etc...) but anyway I think that you should check if a forwarder is sending logs and not if slunkd is running, anyway if there are other problems you cannot receive logs from the forwarder!

So, to check if a forwarder is sending logs you can search on _internal

index=_internal host=your_host

if you don't receive logs there's a problem.

You can create an alert using a lookup (calling e.g. perimeter.csv) containing all the hosts to monitor and running e.g. every 5 minutes the following search:

index=_internal
| eval host=upper(host)
| stats count by host
| append [ 
     | inputlookup perimeter.csv
     | eval host=upper(host), count=0
     | fields host count
     ]
| stats sum(count) AS Total by host
| where Total=0

In this way, hosts where Total=0 are missing and hosts where Total>0 are sending logs.
You can also show host status in a dashboard (also in graphic mode).

Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...