topic Re: How to make a line chart that shows the up time of a forwarder? in Getting Data In

How to make a line chart that shows the up time of a forwarder?

allen_edmondso1 — Wed, 07 Dec 2016 18:09:18 GMT

Hi,

We have a number of forwarders in our Splunk Enterprise. And I've been asked to chart the "uptime" of the forwarders in a monthly report. I've no idea how to do that.

I have made an alert to email me using the metadata command based on type=host if an index hasn't been received in the last 300 seconds. But I need a chart showing when it has been up or down...

Thanks
Allen

Re: How to make a line chart that shows the up time of a forwarder?

somesoni2 — Wed, 07 Dec 2016 18:48:11 GMT

When you use the metadata command, what index do you use? (or if you can provide your metadata command). One way would to be use a timechart command to see when there was an event appearing in (that) index from the host. This can be expensive based on which index is being used (how much data that index has). Other option would be setup a summary index to capture the trend/timechart data at frequent interval and chart based off summary index data (already summarized so will be optimal).

Re: How to make a line chart that shows the up time of a forwarder?

adamsaul — Wed, 07 Dec 2016 18:54:39 GMT

allen_edmonson,

Have you taken a look at "Settings" then the "Monitoring Console"? Enabling Forwarder Monitor will allow you to build these reports pretty quickly.
Splunk Docs :: Set up Forwarder Monitoring

Adam

Re: How to make a line chart that shows the up time of a forwarder?

allenedmondson — Wed, 07 Dec 2016 19:15:49 GMT

Thanks for your answers. I am not at work at the moment... so can't get the exact search. But it was based on one of the examples for the metadata command. @Somesoni2, can you give an example of the summery index data option? Say I am using only one index..
I will also look at the forwarder monitoring option when I get in to work....thanks.

Re: How to make a line chart that shows the up time of a forwarder?

somesoni2 — Wed, 07 Dec 2016 19:24:30 GMT

Some good readings are available here on summary indexing

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Usesummaryindexing
http://www.splunk.com/view/SP-CAAACZW (video)
https://wiki.splunk.com/Community:Summary_Indexing

Re: How to make a line chart that shows the up time of a forwarder?

allenedmondson — Thu, 08 Dec 2016 09:36:19 GMT

This is the search that generates the alert if I don't see anything in the last 5 minutes:

| metadata type=hosts index=Exchange | convert ctime(RecentTime) as recent_Time | where lastTime < (now() - 300) | convert timeformat="%d/%b/%Y %H:%M:%S" ctime(recentTime) | convert timeformat="%d/%b/%Y %H:%M:%S" ctime(lastTime) | convert timeformat="%d/%b/%Y %H:%M:%S" ctime(firstTime)

Thanks

Re: How to make a line chart that shows the up time of a forwarder?

adamsaul — Mon, 12 Dec 2016 15:53:18 GMT

allenedmondson,

Glad it worked out for you!