https://community.splunk.com/t5/Getting-Data-In/Dashboard-with-status-of-a-host/m-p/88211#M18311 <P>awesome.. thanks for the reply.. Will work witht he deployment monitor and the query you have provided. </P> <P><span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 08 Mar 2012 22:23:16 GMT rajbahak 2012-03-08T22:23:16Z https://community.splunk.com/t5/Getting-Data-In/Dashboard-with-status-of-a-host/m-p/88209#M18309 <P>Hello,</P> <P>Is it possible to create a dashbaord that will show the status (online/offline) of the hosts that send their data to be indexed by Splunk? </P> <P>If so please advise how can it be done.</P> <P>Thanks a ton</P> Thu, 08 Mar 2012 19:53:00 GMT https://community.splunk.com/t5/Getting-Data-In/Dashboard-with-status-of-a-host/m-p/88209#M18309 rajbahak 2012-03-08T19:53:00Z https://community.splunk.com/t5/Getting-Data-In/Dashboard-with-status-of-a-host/m-p/88210#M18310 <P>If you turn on the Splunk Deployment Monitor app, you will get a number of dashboards and statistics, including some information about the forwarders. Or, you can try this search (which I lifted from one of the Deployment Monitor dashboards)</P> <PRE><CODE>index="_internal" source="*metrics.log" group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | eval connectionType=case(fwdType=="uf","Universal Forwarder", fwdType=="lwf", "Light Weight Forwarder",fwdType=="full", "Splunk Indexer", connectionType=="cooked" or connectionType=="cookedSSL","Splunk Forwarder", connectionType=="raw" or connectionType=="rawSSL","Legacy Forwarder") | eval build=if(isnull(build),"n/a",build) | eval version=if(isnull(version),"pre 4.2",version) | eval guid=if(isnull(guid),sourceHost,guid) | eval os=if(isnull(os),"n/a",os)| eval arch=if(isnull(arch),"n/a",arch) | eval my_splunk_server = splunk_server | fields connectionType sourceIp sourceHost sourcePort destPort kb tcp_eps tcp_Kprocessed tcp_KBps my_splunk_server build version os arch | eval lastReceived = if(kb&gt;0, _time, null) | stats first(sourceIp) as sourceIp first(connectionType) as connectionType first(sourcePort) as sourcePort first(build) as build first(version) as version first(os) as os first(arch) as arch max(_time) as lastConnected max(lastReceived) as lastReceived sum(kb) as kb avg(tcp_eps) as avg_eps by sourceHost | stats first(sourceIp) as sourceIp first(connectionType) as connectionType first(sourcePort) as sourcePort first(build) as build first(version) as version first(os) as os first(arch) as arch max(lastConnected) as lastConnected max(lastReceived) as lastReceived first(kb) as KB first(avg_eps) as eps by sourceHost | eval status = if(isnull(KB) or lastConnected&lt;(info_max_time-900),"missing",if(lastConnected&gt;(lastReceived+300) or KB==0,"quiet","active")) | sort sourceHost </CODE></PRE> <P>Also, look here for more help: <A href="http://www.splunk.com/wiki/Deploy:Splunk_Metric_Reports" target="_blank">http://www.splunk.com/wiki/Deploy:Splunk_Metric_Reports</A> There are a number of useful (and shorter) searches there.</P> Mon, 28 Sep 2020 11:30:01 GMT https://community.splunk.com/t5/Getting-Data-In/Dashboard-with-status-of-a-host/m-p/88210#M18310 lguinn2 2020-09-28T11:30:01Z https://community.splunk.com/t5/Getting-Data-In/Dashboard-with-status-of-a-host/m-p/88211#M18311 <P>awesome.. thanks for the reply.. Will work witht he deployment monitor and the query you have provided. </P> <P><span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 08 Mar 2012 22:23:16 GMT https://community.splunk.com/t5/Getting-Data-In/Dashboard-with-status-of-a-host/m-p/88211#M18311 rajbahak 2012-03-08T22:23:16Z