Why S.o.S - Splunk on Splunk Deployment Toplogy view shows some forwarders are not reporting in, but searches show different?

[thomasbn]

Some of our team has been looking through the SOS topology view, and when we use the status overlay, some of the servers show up as black. Some of them do not report in to splunk if we do searches for those hosts, but some of them are reporting in within the last 24 hours. Is there a specific criteria that splunk looks for when it overlays the status on the topology page? Thank you

[hexx · Accepted solution]

As far as forwarders are concerned, the status overlay on the S.o.S topology view has 3 states:

• Up: The forwarder has connected at least once to at least one indexer in the last 15 minutes
• Down: The forwarder has connected before but has not been seen by any indexer in the last 15 minutes
• Missing: Indexers report no connection from this forwarder