topic Re: Splunk Alert: Forwarder Offline is sending an alert every hour in Getting Data In

Splunk Alert: Forwarder Offline is sending an alert every hour

afawad — Sat, 23 Dec 2017 04:40:48 GMT

Splunk Alert: Forwarder Offline is sending an alert every hour however the SplunkForwarder is not offline. Please help how could i get rid of this alert (Splunk Alert: Forwarder Offline )

The alert condition for 'Forwarder Offline' was triggered.

Instance Type Version OS Architecture Status Last Connected to Indexers Total KB Average KB/s Over Time Average KB/s Average Events/s
DXX-DC03 Universal Forwarder 6.3.3 Windows x64 missing N/A N/A N/A N/A

Thanks in advance for the help.

Re: Splunk Alert: Forwarder Offline is sending an alert every hour

p_gurav — Tue, 26 Dec 2017 04:28:44 GMT

Hi afawad,

Could you please share the splunk search you used for this alert?

Re: Splunk Alert: Forwarder Offline is sending an alert every hour

nikita_p — Tue, 26 Dec 2017 06:09:40 GMT

Hi @afawad,
Can you try rebuilding your forwarder asset table in your deployment server.
Click rebuild forwarder assets in Monitoring Console > Settings > Forwarder Monitoring Setup.
You can check below splunk docs as well.
https://docs.splunk.com/Documentation/Splunk/7.0.1/DMC/Configureforwardermonitoring

Re: Splunk Alert: Forwarder Offline is sending an alert every hour

afawad — Thu, 28 Dec 2017 13:25:32 GMT

You have shared the link for Splunk enterprise but I am having an issue with UF.