https://community.splunk.com/t5/Getting-Data-In/How-to-get-Forwarder-Event-Detection-within-a-specific-period-of/m-p/323875#M60315 <P>hello there,</P> <P>there are many solutions around it, and many answers here around this topic.<BR /> here is a quick and dirty solution i use:</P> <PRE><CODE>| tstats count where index=_internal by host </CODE></PRE> <P>that will let you know there is a connection since the forwarders always sends their internal logs, so you can run it and see if count is 0 in a period of time then you might want to check that forwarder<BR /> another way i report on last event seen from a forwarder is:</P> <PRE><CODE>| tstats max(_time) as last_event where index=_internal by host | eval now_time = now() | eval event_secondes_ago = now_time - last_event </CODE></PRE> <P>if you care about the data a forwarder sends to the data indexes, change <CODE>index=_internal to index=*</CODE><BR /> you can go many ways from here</P> <P>hope it helps</P> Tue, 27 Feb 2018 19:14:46 GMT adonio 2018-02-27T19:14:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Forwarder-Event-Detection-within-a-specific-period-of/m-p/323874#M60314 <P>We are trying to develop a solution that will allow us the ability to be notified when a forwarder has not sent an event within a specific period of time? We need to find a way to ensure our forwarders are sending log events.</P> <P>Has anyone done something like this? What would be the best way to go about this? </P> Tue, 27 Feb 2018 17:55:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Forwarder-Event-Detection-within-a-specific-period-of/m-p/323874#M60314 cboillot 2018-02-27T17:55:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Forwarder-Event-Detection-within-a-specific-period-of/m-p/323875#M60315 <P>hello there,</P> <P>there are many solutions around it, and many answers here around this topic.<BR /> here is a quick and dirty solution i use:</P> <PRE><CODE>| tstats count where index=_internal by host </CODE></PRE> <P>that will let you know there is a connection since the forwarders always sends their internal logs, so you can run it and see if count is 0 in a period of time then you might want to check that forwarder<BR /> another way i report on last event seen from a forwarder is:</P> <PRE><CODE>| tstats max(_time) as last_event where index=_internal by host | eval now_time = now() | eval event_secondes_ago = now_time - last_event </CODE></PRE> <P>if you care about the data a forwarder sends to the data indexes, change <CODE>index=_internal to index=*</CODE><BR /> you can go many ways from here</P> <P>hope it helps</P> Tue, 27 Feb 2018 19:14:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Forwarder-Event-Detection-within-a-specific-period-of/m-p/323875#M60315 adonio 2018-02-27T19:14:46Z