topic Re: Forwarder Installation date - Audit in Installation

Forwarder Installation date - Audit

ramprakash — Mon, 15 Jun 2020 17:07:06 GMT

Hi Splunkers,

I want list of all the forwarders with their first installation date or exactly since when they are sending data to Indexers.

Can someone please provide any details on this. Appreciate your help on this. Thanks !

Re: Forwarder Installation date - Audit

p_gurav — Wed, 13 Mar 2019 09:13:12 GMT

Hi,

You can try using below query to get first event come from forwarder:

index=_* | stats earliest(_time) as FirstAppearance by host

Re: Forwarder Installation date - Audit

nickhills — Wed, 13 Mar 2019 09:30:08 GMT

Hi @ramprakash
Use the metadata command:

| metadata type=hosts index=_internal | eval first_connected=strftime(firstTime, "%Y/%m/%d %H:%M:%s")
| table host first_connected

This will show you the earliest event from Splunk for your hosts, you can then search with |search host=xxx

Re: Forwarder Installation date - Audit

whrg — Wed, 13 Mar 2019 09:48:13 GMT

To add to @nickhillscpl answer:
Set the time range picker to "All Time".
Also note that this search will retrieve the earliest events in the _internal index which are still available in Splunk. Older events might have been discarded due to exceeded retention periods or full indexes.

Re: Forwarder Installation date - Audit

nickhills — Wed, 13 Mar 2019 09:54:43 GMT

Thanks @whrg - I should have noted that!

If your _internal retention is shorter than your application/security data, you can always switch to index=myindex to look at the earliest event from a specific index

Re: Forwarder Installation date - Audit

ramprakash — Thu, 14 Mar 2019 11:34:34 GMT

yes older events have been discarded. This query is not giving me results i wanted.

Is there any other query which will give me first installation date.