topic Re: Is there an SPL query to know the last date UFs phoned in to a specific DS? in Splunk Search

Is there an SPL query to know the last date UFs phoned in to a specific DS?

So76 — Tue, 19 Jul 2022 00:47:59 GMT

Is there an SPL query to know the last date UFs phoned in to a specific DS. We've many DS in our company

Re: Is there an SPL query to know the last date UFs phoned in to a specific DS?

Roy_9 — Tue, 19 Jul 2022 04:43:20 GMT

below search gives you the list of UF's that haven't phoned in last 24 hours, you could tweak this search.

| rest splunk_server=local /services/deployment/server/clients | eval now=now(), diffTime=now-lastPhoneHomeTime, lastPhoneHomeTime=strftime(lastPhoneHomeTime,"%b %d, %Y %H:%M:%S") | search diffTime>86400 | table hostname ip instanceName utsname package splunkVersion lastPhoneHomeTime

Re: Is there an SPL query to know the last date UFs phoned in to a specific DS?

gcusello — Tue, 19 Jul 2022 06:52:36 GMT

Hi @So76,

you can use the search from @Roy_9 that's correct or to use the Monitoring Console that gives you all the information about Forwarders, not only last phoned date.

Ciao.

Giuseppe

Re: Is there an SPL query to know the last date UFs phoned in to a specific DS?

So76 — Tue, 19 Jul 2022 13:12:44 GMT

Thanks for you prompt response. Can it be narrowed to a specific DS? We've multiple DS

Re: Is there an SPL query to know the last date UFs phoned in to a specific DS?

gcusello — Tue, 19 Jul 2022 13:29:46 GMT

Hi @So76,

for this reasono, Monitoring Console is the easiest way.

Ciao.

Giuseppe

Re: Is there an SPL query to know the last date UFs phoned in to a specific DS?

gcusello — Wed, 20 Jul 2022 06:24:08 GMT

Hi @So76 ,

if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors;-)

Re: Is there an SPL query to know the last date UFs phoned in to a specific DS?

So76 — Wed, 20 Jul 2022 13:07:58 GMT

used the monitoring console