Getting Data In

Can I see if a network interface is left ON?

splunktrainingu
Communicator

I have an Enclave server that already forwards logs to my indexer. We installed a network interface that should remain turned off unless we are upgrading/patching the server. Is there a way to see if the Network interface was left ON?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the state of the network interface is in Splunk, then you can search for it to see if it's on or not.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

splunktrainingu
Communicator

How can I see if the state of the network interface is in splunk? What would I be searching for?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I have to defer to a local data expert (hopefully, that's you). Try searching for the interface name.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

splunktrainingu
Communicator

I am seeing the perfmon interface logs but not from all the hosts only some.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you see the network interface for the Enclave server then you should be all set. Otherwise, you have some onboarding or troubleshooting to do.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

splunktrainingu
Communicator

Looks like I have a lot of onboarding to do I am able to see my forwarders but I am not getting logs for some of the devices.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!