topic Re: Validate Splunk Forwarder Status in Getting Data In

How to validate Splunk forwarder status?

nbteal — Mon, 14 Nov 2022 18:27:07 GMT

Our organization currently hosts a "Splunk Health" dashboard. This dashboard has a panel that shows the heartbeat interval and overdue status of all the known splunk forwarders. However, what this dashboard does not have is a panel that can identify any valid endpoint on network that does not have the splunk forwarder installed.

Problem Statement: Add panel to dashboard that depicts any valid endpoint without Splunk forwarder installed.

I am fairly new to splunk. However, I thought that the best way to tackle would be to pull a csv from AD of all valid endpoints (WS, Servers, etc) and host as a lookup table file within Splunk. Then identify a query that compare current "clients" in Forwarder Management against the new lookup table file (AD output). The results would show me any endpoint that is not currently a client within Forwarder Management.

Any help would be appreciated. Thank you.

Re: Validate Splunk Forwarder Status

gcusello — Mon, 14 Nov 2022 16:55:03 GMT

Hi @nbteal,

you are asking an Asset Discovery feature, but Splunk, by itself, cannot monitor devices not connected with it.

Asset dispovery is usually done by Vulnerability Assessment or CMDB systems, not using a log management system.

But you could use this apphttps://apps.splunk.com/app/662/ that perform a scan on your network (using scripts) identifying all the object on your network and executing a compare with the monitored systems.

Ciao.

Giuseppe

Re: Validate Splunk Forwarder Status

nbteal — Mon, 14 Nov 2022 17:14:27 GMT

@gcusello

Thank you for the information. Was tracking splunk cant monitor systems that arent connected to the server. Was hoping it may be able to perform a compare against a lookup file and known "clients/forwarders".

I'll take a look at the app you suggested.

Thank you again for your time and have a nice day.

Re: Validate Splunk Forwarder Status

gcusello — Mon, 14 Nov 2022 17:20:19 GMT

Hi @nbteal,

yes, it's a best practice to implement always a check between the perimeter to monitor (usually a lookup) and the connected systems to immediately identify eventual missing systems.

Ciao.

Giuseppe