topic Re: Can I see if a network interface is left ON? in Getting Data In

Can I see if a network interface is left ON?

splunktrainingu — Wed, 29 Apr 2020 18:47:26 GMT

I have an Enclave server that already forwards logs to my indexer. We installed a network interface that should remain turned off unless we are upgrading/patching the server. Is there a way to see if the Network interface was left ON?

Re: Can I see if a network interface is left ON?

richgalloway — Wed, 29 Apr 2020 18:54:39 GMT

If the state of the network interface is in Splunk, then you can search for it to see if it's on or not.

Re: Can I see if a network interface is left ON?

splunktrainingu — Wed, 29 Apr 2020 19:00:14 GMT

How can I see if the state of the network interface is in splunk? What would I be searching for?

Re: Can I see if a network interface is left ON?

richgalloway — Wed, 29 Apr 2020 19:08:48 GMT

I have to defer to a local data expert (hopefully, that's you). Try searching for the interface name.

Re: Can I see if a network interface is left ON?

splunktrainingu — Wed, 29 Apr 2020 19:35:41 GMT

I am seeing the perfmon interface logs but not from all the hosts only some.

Re: Can I see if a network interface is left ON?

richgalloway — Wed, 29 Apr 2020 19:56:10 GMT

If you see the network interface for the Enclave server then you should be all set. Otherwise, you have some onboarding or troubleshooting to do.

Re: Can I see if a network interface is left ON?

splunktrainingu — Wed, 29 Apr 2020 20:13:58 GMT

Looks like I have a lot of onboarding to do I am able to see my forwarders but I am not getting logs for some of the devices.