Deployment Architecture

how to find forwarders in which splunk boot-start is enabled ?

nilbak1
Communicator

I want to find the splunk forwarders in which boot script is enabled.
Is there any query ?

0 Karma
1 Solution

ansif
Motivator

I don't know the query. If you find any log files that logs boot start then you can use that log file to search.

Rather you can use scripts to determine if boot start enabled or NOT.

For Windows forwarders use Powershell script to get Splunk service startup status.

Linux machines use shell script to check if Sxxsplunk link file exist under /etc/rc.d/rc3.d (example S90splunk )

Both scripts use your servernames as input.

View solution in original post

0 Karma

ansif
Motivator

I don't know the query. If you find any log files that logs boot start then you can use that log file to search.

Rather you can use scripts to determine if boot start enabled or NOT.

For Windows forwarders use Powershell script to get Splunk service startup status.

Linux machines use shell script to check if Sxxsplunk link file exist under /etc/rc.d/rc3.d (example S90splunk )

Both scripts use your servernames as input.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!