Getting Data In

Can I see if a network interface is left ON?

splunktrainingu
Communicator

I have an Enclave server that already forwards logs to my indexer. We installed a network interface that should remain turned off unless we are upgrading/patching the server. Is there a way to see if the Network interface was left ON?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the state of the network interface is in Splunk, then you can search for it to see if it's on or not.

---
If this reply helps you, Karma would be appreciated.
0 Karma

splunktrainingu
Communicator

How can I see if the state of the network interface is in splunk? What would I be searching for?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I have to defer to a local data expert (hopefully, that's you). Try searching for the interface name.

---
If this reply helps you, Karma would be appreciated.
0 Karma

splunktrainingu
Communicator

I am seeing the perfmon interface logs but not from all the hosts only some.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you see the network interface for the Enclave server then you should be all set. Otherwise, you have some onboarding or troubleshooting to do.

---
If this reply helps you, Karma would be appreciated.
0 Karma

splunktrainingu
Communicator

Looks like I have a lot of onboarding to do I am able to see my forwarders but I am not getting logs for some of the devices.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...