Deployment Architecture

How to get the list of UF & HF in Splunk Cloud?

alexspunkshell
Contributor

How to get UF & HF list in Splunk Cloud

0 Karma

Roy_9
Motivator

@alexspunkshell You can view by navigating to forwarder management else you can try the below query 


index="_internal" source="*metrics.lo*" group=tcpin_connections fwdType=uf | dedup hostname| table hostname,sourceIp,fwdType,guid,version,build,os,arch

alexspunkshell
Contributor

@Roy_9 @richgalloway 

How to check the forwarders/host which is not reporting for more than 60 days.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's possible the computer was taken out of service.

If it's still there, login to the box and confirm the forwarder is present and running.  Re-installed or restart it, as necessary.  To help avoid this problem in the future, make sure the UF is configure to start at boot-up.  Consider using GPO or similar features to ensure the UF stays installed and running.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

See the Forwarders menu in the Cloud Monitoring Console app.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...