topic Re: IS there any script how we can check SPlunk agent is inactive in user server. in Splunk Search

IS there any script how we can check SPlunk agent is inactive in user server.

sahils — Mon, 10 Apr 2017 13:05:18 GMT

IS there any script or how we can check SPlunk agent is inactive in user server.
I received email or notification If SPlunk agent is not running on user servers.

Thanks,
Sahil

Re: IS there any script how we can check SPlunk agent is inactive in user server.

martin_mueller — Mon, 10 Apr 2017 13:21:10 GMT

You can check if splunk is active by running splunk status on the CLI.

Re: IS there any script how we can check SPlunk agent is inactive in user server.

andrey2007 — Tue, 29 Sep 2020 13:35:26 GMT

You can use Deployment server to manage agents(fowrwarders) which usually phoning home to deployemnet server
to know agent status you can use following search and configure alert for specific host

index=_internal (phonehome component=DC*) OR (component=DC:HandshakeReplyHandler) host=hostname
| sort _time
| table _time host log_level message

it is from https://answers.splunk.com/answers/208607/how-to-determine-if-forwarder-is-phoning-home-to-d.html

Re: IS there any script how we can check SPlunk agent is inactive in user server.

lycollicott — Mon, 10 Apr 2017 13:40:45 GMT

You could write a script, but why don't you use the Monitoring Console? If you configured your Splunk to send emails then it can email you when a forwarder is missing, too.

Look at the bottom of this screen shot.

You can get started with the Monitoring Console here: https://docs.splunk.com/Documentation/Splunk/6.5.3/DMC/DMCoverview

Re: IS there any script how we can check SPlunk agent is inactive in user server.

sahils — Wed, 21 Jun 2017 16:05:24 GMT

Thanks Andrey We are checking status in Deployment Server But If agent goes down We are not aware in which server or which application is impacted Is there any script , query or How we notify automatically tell us in Which server agent is down.

Regards,
Sahil

Re: IS there any script how we can check SPlunk agent is inactive in user server.

sahils — Wed, 21 Jun 2017 16:06:52 GMT

Hello,

We are checking status in Deployment Server But If agent goes down We are not aware in which server or which application is impacted Is there any script , query or How we notify automatically tell us in Which server agent is down.

Thanks,
Sahil

Re: IS there any script how we can check SPlunk agent is inactive in user server.

sahils — Thu, 22 Jun 2017 15:18:15 GMT

Any update?

Thanks,
Sahil

Re: IS there any script how we can check SPlunk agent is inactive in user server.

lycollicott — Thu, 06 Jul 2017 17:48:33 GMT

Do you maintain an up to date list of all the servers in your environment?

Re: IS there any script how we can check SPlunk agent is inactive in user server.

lycollicott — Tue, 18 Jul 2017 12:57:00 GMT

If the agent (UF) goes down then this will tell you it has stopped. That is what "missing" means.