Deployment Architecture
Highlighted

Change DM Missing Forwarder to look for forwarders that have not connected in last 10 minutes

Path Finder

I need to know if a forwarder has not connected in the last 10 minutes.

What I really want to do is look for -->> now - lastConnected > 600 seconds

But I don't know how to find "now".

Instead I'm using :

all_forwarders | sort - lastConnected | delta lastConnected AS forwarderlag p=1 | fields sourceHost lastConnected forwarderlag status | rename sourceHost as "Forwarder" sourceIp as "Source IP" connectionType as "Forwarder Type" lastConnected as "Last Connected" status as "Current Status" | fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p") | search forwarder_lag<-600

This works on the assumption that at least one of my forwarders is current connected. But it is not very elegant.

How do I find "now"?

Thanks.

Signed: Splunk Newbie

Highlighted

Re: Change DM Missing Forwarder to look for forwarders that have not connected in last 10 minutes

SplunkTrust
SplunkTrust

Well, "now" is available conveniently as now() in an eval operation - and also in a where command (since where derives some functionality from eval). So, something like this may work (not I've not tested it):

`all_forwarders` | sort - lastConnected | delta lastConnected AS forwarder_lag p=1 
| fields sourceHost lastConnected forwarder_lag status 
| rename sourceHost as "Forwarder" sourceIp as "Source IP" 
connectionType as "Forwarder Type" lastConnected as "Last Connected" 
status as "Current Status" 
| fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p") 
| where forwarder_lag < (now()-600)

View solution in original post

0 Karma
Highlighted

Re: Change DM Missing Forwarder to look for forwarders that have not connected in last 10 minutes

Path Finder

I know I will refer to this again. I'm so green it's painful. 😛 For now however, my DM seems to be behaving better/differently and is alerting me when my forwarders go silent pretty soon after they do so. So I think I'm good for now.

Thanks again for giving me a solution.

0 Karma
Highlighted

Re: Change DM Missing Forwarder to look for forwarders that have not connected in last 10 minutes

Path Finder

I am now satisfied with the DM and its alerting. So this has become moot. But like dwaddle's answer.

0 Karma
Highlighted

Re: Change DM Missing Forwarder to look for forwarders that have not connected in last 10 minutes

SplunkTrust
SplunkTrust

Awesome. Could you accept the answer then? (That way, it falls off the list of 'unanswered' posts .. and I get a little karma woo)

0 Karma