topic Re: Search for client disconnects from Indexer? in Getting Data In

Search for client disconnects from Indexer?

splunktrainingu — Mon, 08 Jul 2024 16:38:42 GMT

Is there a way to monitor disconnects on a host (with a deployed universal forwarder) that cannot reach the Indexer? We have an on prem solution. Simply trying to use this host to monitor if network A can reach network B because the host is in Network A and the index is in network B.

Re: Search for client disconnects from Indexer?

richgalloway — Mon, 08 Jul 2024 17:14:39 GMT

If the host cannot reach the indexer then there will be nothing logged on the indexer to monitor. The UF will log any failures to connect so that is the place to check, but you will have to do that on the host rather than in Splunk.

Re: Search for client disconnects from Indexer?

splunktrainingu — Mon, 08 Jul 2024 17:17:34 GMT

Would this be logged into the metrics log on the UF? I could monitor for no logs, I have done that in the past.

Re: Search for client disconnects from Indexer?

richgalloway — Mon, 08 Jul 2024 17:44:54 GMT

The UF will log communication failures in splunkd.log.

Yes, you can monitor the indexers for no logs from hosts. There are apps, including TrackMe, that can help with that.

Re: Search for client disconnects from Indexer?

splunktrainingu — Mon, 08 Jul 2024 18:24:58 GMT

So there is no way to monitor the splunkd.log on the UF from the Splunk Indexer?

Re: Search for client disconnects from Indexer?

richgalloway — Mon, 08 Jul 2024 18:36:02 GMT

Normally, the UF is monitored from the indexers, but if the UF cannot connect to the indexer it cannot send its logs so there's no data to monitor.