Deployment Architecture

Any Ideas--Ensure metadata, tstats, lookups, and deployment server are in sync

nahfam
Path Finder

Hey all,

We have hit-and-miss identification of servers that fall off of Splunk monitoring. There needs to be a critical alert if a non-decommissioned server:

1.Stops reporting to Splunk, or
2.Stops phoning home to the deployment server

Is there a weay to query the rest api from the search head to determind Deployment server contact?

Any help is much apprreciated..

Tags (1)
0 Karma

darrenfuller
Contributor

If your deployment server is forwarding its internal logs to your indexing layer, you should be able to use a query like:

index=_internal host="Your_deployment_server_hostname" "/services/broker/phonehome/"
| stats max(_time) AS last_checkin_epoch by clientip
| eval now_epoch=now()
| eval time_since_last_checkin=now_epoch-last_checkin_epoch
| sort - time_since_last_checkin

./DF

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...