topic Query for Splunk Forwarder is active or not? in Getting Data In

Query for Splunk Forwarder is active or not?

sneha0924 — Mon, 26 Apr 2021 10:07:49 GMT

We have received an alert for splunk Forwarder not active on 1 host. We are not able go see the contributing events for this.

Could you please help me with the query to search whether splunk Forwarder is active or not?

Re: Query for Splunk Forwarder is active or not?

gcusello — Mon, 26 Apr 2021 11:22:19 GMT

Hi @sneha0924,

Let me understand: do you want a search to have an alert when a forwarder is down or to debug this condition?

if you want an alert, you have to create a lookup (called e.g. perimeter.csv) containing all the hostnames to monitor in your perimeter, containing at least one column (host), and run a search like this:

if instead you want to debug a forwarder that isn't sending logs, you have to go in SSH on that machine and then: check the connection with telnet and see local Splunk logs to debug the problem.

Ciao.

Giuseppe

Re: Query for Splunk Forwarder is active or not?

sneha0924 — Mon, 26 Apr 2021 11:28:45 GMT

Hi @gcusello

Thanks for your response.

I want to debug a forwarder that isn't sending logs.

I Will follow the steps which you have provided and will update you.

Thanks

I will try an