Hi Guys
Is there a search that can pull back the forwarders that are missing / not sending data at a point in time, so if 100 were reporting in yesterday, I'm after a report that looks at what's sending logs now and compare to what was sending in at the same time yesterday and display the missing forwarders at this point in time.
I hope that makes sense.
Thanks
Try this
index=_internal sourcetype=splunkd destPort!="-"| stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - count
Hey, thank you.
That's not quite what I need but it will help me with a different task I have so thank you 🙂