https://community.splunk.com/t5/Getting-Data-In/Monitoring-Forwarder-Uptime/m-p/107580#M22615 <P>I am looking to set up a monitoring tool (HP's Sitescope) to "watch" our forwarders to ensure they are up. I am not sure specifically what I should watch in the forwarder (port, process, etc). It seems the outgoing port changes after each restart, and I'm not sure that monitoring the Management Host Port (8089) would provide an accurate indication if the forwarder stopped working.</P> <P>Running Splunk 4.1.2.. I know 4.2 has forwarder monitoring built in, but I'm looking for an interim solution.</P> <P>Thank you,<BR /> DevonK</P> Mon, 23 May 2011 18:22:20 GMT devonk 2011-05-23T18:22:20Z https://community.splunk.com/t5/Getting-Data-In/Monitoring-Forwarder-Uptime/m-p/107580#M22615 <P>I am looking to set up a monitoring tool (HP's Sitescope) to "watch" our forwarders to ensure they are up. I am not sure specifically what I should watch in the forwarder (port, process, etc). It seems the outgoing port changes after each restart, and I'm not sure that monitoring the Management Host Port (8089) would provide an accurate indication if the forwarder stopped working.</P> <P>Running Splunk 4.1.2.. I know 4.2 has forwarder monitoring built in, but I'm looking for an interim solution.</P> <P>Thank you,<BR /> DevonK</P> Mon, 23 May 2011 18:22:20 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-Forwarder-Uptime/m-p/107580#M22615 devonk 2011-05-23T18:22:20Z https://community.splunk.com/t5/Getting-Data-In/Monitoring-Forwarder-Uptime/m-p/107581#M22616 <P>i know you're thinking of using an external solution, but you could also set up an alert using this search:</P> <PRE><CODE>| metadata type=hosts | eval age = now() - lastTime | search age &gt; 86400 | sort age d | convert ctime(lastTime) | fields age,host,lastTime </CODE></PRE> <P>to show you forwarders that haven't been heard from in the last 24 hours. </P> Mon, 23 May 2011 20:08:46 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-Forwarder-Uptime/m-p/107581#M22616 piebob 2011-05-23T20:08:46Z