https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-deployed-universal-forwarders/m-p/186172#M37306 <P>Hi joshk2005,</P> <P>check out the deployment monitor app <A href="https://apps.splunk.com/app/1294/">https://apps.splunk.com/app/1294/</A> which includes such searches like missing forwarder and other stuff which can be useful. Also check out the S.o.S app <A href="https://apps.splunk.com/app/748/">https://apps.splunk.com/app/748/</A> or if you're using Splunk 6.2 have a look at the <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole">http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole</A></P> <P>cheers, MuS</P> Mon, 19 Jan 2015 13:45:16 GMT MuS 2015-01-19T13:45:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-deployed-universal-forwarders/m-p/186171#M37305 <P>We sporadically have had issues where the forwarder service stops working due to the need to clear locks on the client. Is there a good search string that we could use to alert off of when specific forwarders stop working? We are specifically looking to ensure that our domain controllers do not stop forwarding data (for long) due to the forwarder service not running.</P> Mon, 19 Jan 2015 13:33:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-deployed-universal-forwarders/m-p/186171#M37305 joshk2005 2015-01-19T13:33:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-deployed-universal-forwarders/m-p/186172#M37306 <P>Hi joshk2005,</P> <P>check out the deployment monitor app <A href="https://apps.splunk.com/app/1294/">https://apps.splunk.com/app/1294/</A> which includes such searches like missing forwarder and other stuff which can be useful. Also check out the S.o.S app <A href="https://apps.splunk.com/app/748/">https://apps.splunk.com/app/748/</A> or if you're using Splunk 6.2 have a look at the <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole">http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole</A></P> <P>cheers, MuS</P> Mon, 19 Jan 2015 13:45:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-deployed-universal-forwarders/m-p/186172#M37306 MuS 2015-01-19T13:45:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-deployed-universal-forwarders/m-p/186173#M37307 <P>Deployment monitor app is a great tool. There is even built in options to create alerts easily - great time saver. </P> Tue, 20 Jan 2015 18:45:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-deployed-universal-forwarders/m-p/186173#M37307 trsavela 2015-01-20T18:45:55Z