Archive
Highlighted

how to find forwarders in which splunk boot-start is enabled ?

Communicator

I want to find the splunk forwarders in which boot script is enabled.
Is there any query ?

0 Karma
Highlighted

Re: how to find forwarders in which splunk boot-start is enabled ?

Motivator

I don't know the query. If you find any log files that logs boot start then you can use that log file to search.

Rather you can use scripts to determine if boot start enabled or NOT.

For Windows forwarders use Powershell script to get Splunk service startup status.

Linux machines use shell script to check if Sxxsplunk link file exist under /etc/rc.d/rc3.d (example S90splunk )

Both scripts use your servernames as input.

View solution in original post

0 Karma