All Apps and Add-ons

How to check active nodes connected to Splunk forwarder?

tulgabatm
New Member

How to check active nodes sending logs to Splunk forwarder and also how to check that Splunk forwarder is sending all these nodes to Indexer?

Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @tulgabatm,

to have an overview of perimeter health status, you have at first to create a lookup containing all the systems to monitor in your perimeter (called e.g. perimeter.csv), in this lookup there must be at least one column (called e.g. host), but it can contain also other informations to enrich your results.

Then you have to run a search like this:

| metasearch index=_internal OR index=*
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv host | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

Some clarifications:

  • you can use | metasearch so you have a faster search;
  • In this search: total=0 means that you haven't logs from a target;
  • if you have only servers with Universal Forwarders (without syslogs or other inputs), you can use only index=_internal (without index=*) so you'll have a faster search;
  • if you have only servers with Universal Forwarders, you're sure that you have a correct check also when you haven't any log to receive because you always have the UF logs;
  • if you also have syslogs or HEC, in other words logs without UF, you have the problem that you could have a false positive alarm because you aren't receiving logs because there isn't any log to receive, so (if possible) try to create an heartbeat;
  • Using this search (without the last row) you can also have an overview of your infrastructure that you can also display in graphic mode.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...