topic Re: How do we determine whether a forwarder phoned home recently? in Getting Data In

How do we determine whether a forwarder phoned home recently?

ddrillic — Tue, 02 May 2017 19:49:34 GMT

Is there a rest call to figure out whether a forwarder phoned home in the past hour? We would like to run this call against a list of servers.

Re: How do we determine whether a forwarder phoned home recently?

DalJeanis — Tue, 02 May 2017 19:54:02 GMT

... newer answer...

https://answers.splunk.com/answers/319970/what-options-are-there-to-find-if-a-forwarder-has.html

...older answers...

https://answers.splunk.com/answers/41447/query-alert-to-detect-if-a-light-forwarder-stops-reporting-to-deployment-server.html

https://answers.splunk.com/answers/798/how-do-i-tell-if-a-forwarder-is-down.html

Re: How do we determine whether a forwarder phoned home recently?

mattymo — Tue, 02 May 2017 22:30:28 GMT

Try this search on against your DS, or use the CLI version (http://docs.splunk.com/Documentation/Splunk/6.6.0/RESTREF/RESTdeploy#deployment.2Fserver.2Fclients):

| rest /services/deployment/server/clients

It will give you some great info about your forwarders which you could then subsearch against to look for your forwarders calling home to the DS.

Mainly you will want lastPhoneHomeTime with with a lil eval to determine if they haven't phone home in n minutes. This example uses 900 secons aka 15 mins:

| rest /services/deployment/server/clients | fields hostname lastPhoneHomeTime | eval status = if(lastPhoneHomeTime < (now() - 900), "missing", "active")

Obviously if you have a large number of forwarders you will want to filter down by name (https://:/services/deployment/server/clients/{name})

This is all to look for UF to DS communication. If you are actually looking for UF connecting to IDX, then please use the Monitoring Console forwarder management options.

Re: How do we determine whether a forwarder phoned home recently?

ddrillic — Wed, 03 May 2017 11:07:16 GMT

Perfect - thank you.