Deployment Architecture

Change DM Missing Forwarder to look for forwarders that have not connected in last 10 minutes

krussell101
Path Finder

I need to know if a forwarder has not connected in the last 10 minutes.

What I really want to do is look for -->> now - lastConnected > 600 seconds

But I don't know how to find "now".

Instead I'm using :

all_forwarders | sort - lastConnected | delta lastConnected AS forwarder_lag p=1 | fields sourceHost lastConnected forwarder_lag status | rename sourceHost as "Forwarder" sourceIp as "Source IP" connectionType as "Forwarder Type" lastConnected as "Last Connected" status as "Current Status" | fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p") | search forwarder_lag<-600

This works on the assumption that at least one of my forwarders is current connected. But it is not very elegant.

How do I find "now"?

Thanks.

Signed: Splunk Newbie

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Well, "now" is available conveniently as now() in an eval operation - and also in a where command (since where derives some functionality from eval). So, something like this may work (not I've not tested it):

`all_forwarders` | sort - lastConnected | delta lastConnected AS forwarder_lag p=1 
| fields sourceHost lastConnected forwarder_lag status 
| rename sourceHost as "Forwarder" sourceIp as "Source IP" 
connectionType as "Forwarder Type" lastConnected as "Last Connected" 
status as "Current Status" 
| fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p") 
| where forwarder_lag < (now()-600)

View solution in original post

0 Karma

krussell101
Path Finder

I am now satisfied with the DM and its alerting. So this has become moot. But like dwaddle's answer.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Awesome. Could you accept the answer then? (That way, it falls off the list of 'unanswered' posts .. and I get a little karma woo)

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Well, "now" is available conveniently as now() in an eval operation - and also in a where command (since where derives some functionality from eval). So, something like this may work (not I've not tested it):

`all_forwarders` | sort - lastConnected | delta lastConnected AS forwarder_lag p=1 
| fields sourceHost lastConnected forwarder_lag status 
| rename sourceHost as "Forwarder" sourceIp as "Source IP" 
connectionType as "Forwarder Type" lastConnected as "Last Connected" 
status as "Current Status" 
| fieldformat "Last Connected"=strftime('Last Connected', "%D %H:%M:%S %p") 
| where forwarder_lag < (now()-600)
0 Karma

krussell101
Path Finder

I know I will refer to this again. I'm so green it's painful. 😛 For now however, my DM seems to be behaving better/differently and is alerting me when my forwarders go silent pretty soon after they do so. So I think I'm good for now.

Thanks again for giving me a solution.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...