https://community.splunk.com/t5/Getting-Data-In/Search-to-find-when-a-forwarder-restarted/m-p/116800#M24357 <P>Hi,</P> <P>Is there a search that I can run that shows when a forwarder starts, and is considered up and running? I want to create transactions - one that shows it starts and is running, and another that shows it started but isn't running (and therefore some errors may exist). </P> Sat, 31 Jan 2015 15:36:48 GMT a212830 2015-01-31T15:36:48Z https://community.splunk.com/t5/Getting-Data-In/Search-to-find-when-a-forwarder-restarted/m-p/116800#M24357 <P>Hi,</P> <P>Is there a search that I can run that shows when a forwarder starts, and is considered up and running? I want to create transactions - one that shows it starts and is running, and another that shows it started but isn't running (and therefore some errors may exist). </P> Sat, 31 Jan 2015 15:36:48 GMT https://community.splunk.com/t5/Getting-Data-In/Search-to-find-when-a-forwarder-restarted/m-p/116800#M24357 a212830 2015-01-31T15:36:48Z https://community.splunk.com/t5/Getting-Data-In/Search-to-find-when-a-forwarder-restarted/m-p/116801#M24358 <P>There are messages in the internal logs, _*. </P> <PRE><CODE>index =_* &nbsp;host=&lt;fwd name&gt; starting </CODE></PRE> <P>Even better is the deployment app, look for all kinds of things and is easy to setup alerts.</P> <P><A href="https://apps.splunk.com/app/1294/">https://apps.splunk.com/app/1294/</A></P> Sun, 01 Feb 2015 19:30:43 GMT https://community.splunk.com/t5/Getting-Data-In/Search-to-find-when-a-forwarder-restarted/m-p/116801#M24358 thomrs 2015-02-01T19:30:43Z