https://community.splunk.com/t5/Getting-Data-In/UF-status-was-not-connected-dashboard/m-p/627049#M107658 <P>Hi All,</P><P>we are working on to create a dashboard on UF status connection by using phone home interval in DS using search below</P><P>but while checking if forwarder phone connection last few secs in DS still it was showing as not connected in list.</P><P>please let us know what needs to be changes in the search to get exact result and also search was running slowly.</P><P>&nbsp;</P><P>index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d<BR />| eval Host=coalesce(hostname, sourceHost)<BR />| eval age=(now()-_time)<BR />| stats<BR />min(age) AS age<BR />max(_time) AS LastTime<BR />BY Host<BR />| convert ctime(LastTime) AS "Last Active On"<BR />| eval Status=if(age&lt; 1800,"Running","DOWN")<BR />| rename age AS Age<BR />| eval Age=tostring(Age,"duration")<BR />| sort Status<BR />| dedup Host<BR />| table Host Status Age "Last Active On",<BR />| where Status="DOWN"</P> Fri, 13 Jan 2023 09:47:56 GMT sekhar463 2023-01-13T09:47:56Z https://community.splunk.com/t5/Getting-Data-In/UF-status-was-not-connected-dashboard/m-p/627049#M107658 <P>Hi All,</P><P>we are working on to create a dashboard on UF status connection by using phone home interval in DS using search below</P><P>but while checking if forwarder phone connection last few secs in DS still it was showing as not connected in list.</P><P>please let us know what needs to be changes in the search to get exact result and also search was running slowly.</P><P>&nbsp;</P><P>index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d<BR />| eval Host=coalesce(hostname, sourceHost)<BR />| eval age=(now()-_time)<BR />| stats<BR />min(age) AS age<BR />max(_time) AS LastTime<BR />BY Host<BR />| convert ctime(LastTime) AS "Last Active On"<BR />| eval Status=if(age&lt; 1800,"Running","DOWN")<BR />| rename age AS Age<BR />| eval Age=tostring(Age,"duration")<BR />| sort Status<BR />| dedup Host<BR />| table Host Status Age "Last Active On",<BR />| where Status="DOWN"</P> Fri, 13 Jan 2023 09:47:56 GMT https://community.splunk.com/t5/Getting-Data-In/UF-status-was-not-connected-dashboard/m-p/627049#M107658 sekhar463 2023-01-13T09:47:56Z https://community.splunk.com/t5/Getting-Data-In/UF-status-was-not-connected-dashboard/m-p/627056#M107659 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/244375">@sekhar463</a>,</P><P>to display forwarders' status I usually use a lookup (called e.g. perimer.csv) containing the Forwarders to monitor (eventually updated using a script) in a field called host and running a search like this:</P><LI-CODE lang="markup">| tstats count WHERE index=_internal BY host | eval host=lower(host) | append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | eval status=if(total=0,"Missing","Present") | table host status</LI-CODE><P>&nbsp;Ciao.</P><P>Giuseppe</P> Fri, 13 Jan 2023 10:54:49 GMT https://community.splunk.com/t5/Getting-Data-In/UF-status-was-not-connected-dashboard/m-p/627056#M107659 gcusello 2023-01-13T10:54:49Z https://community.splunk.com/t5/Getting-Data-In/UF-status-was-not-connected-dashboard/m-p/627059#M107661 <P>In Monitoring Console you can see the forwarder status. There is an in built dashboard available for it. &nbsp;</P><P>Refer for more info about the built in alert/reports:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.3/DMC/Configureforwardermonitoring#Configure_forwarder_monitoring_for_the_Monitoring_Console" target="_blank">Configure forwarder monitoring for the Monitoring Console</A></P> Fri, 13 Jan 2023 12:06:37 GMT https://community.splunk.com/t5/Getting-Data-In/UF-status-was-not-connected-dashboard/m-p/627059#M107661 Jawahir 2023-01-13T12:06:37Z