topic Re: Splunk search to check forwarder status based on last connected time in Getting Data In

Splunk search to check forwarder status based on last connected time

sekhar463 — Thu, 19 Oct 2023 12:41:39 GMT

Hi Team,

i am using this search to check the status of UF"down based on last connection time.

but when i am removing the server from deployment server ,still this search output showing the server in down status, it should not visible in splunk search.

need suggestion on this to get exact output for down status

Re: Splunk search to check forwarder status based on last connected time

cklunck — Tue, 25 Jul 2023 04:02:55 GMT

@sekhar463 wrote:
but when i am removing the server from deployment server ,still this search output showing the server in down status, it should not visible in splunk search.

When you say you're "removing the server from the deployment server", what action specifically are you taking?

If a host appears even just once in the metrics log during the time range you're searching, then it will be included in your result set. If the time it was last seen is older than 7200 seconds, it will be marked as DOWN. Only if your search does not find any results for a host in the metrics log will that host disappear from the result set.

Re: Splunk search to check forwarder status based on last connected time

isoutamo — Tue, 25 Jul 2023 04:21:48 GMT

if you want to keep track on only some UFs on your environment, you should add those to lookup file. Then exclude all other nodes, which you found from internal logs. Of course you must update that lookup every time you manage your UFs.

How this has done? You could found quite many examples from community by google search.

r. Ismo