Getting Data In

Deployment Monitor Missing Forwarders

Splunk Employee
Splunk Employee

The Missing Forwarders dashboard is telling me that there are x number of missing forwarders which "have not connected in the past 24 hours" - However when I check the detailed results, it tells me that the "last_connected" time for some of the forwarders, is indeed a time which is within 24 hours of the current time?

Can anyone help me out here as to why this is happening?


Check the instance on the specific server. I've had Deployment Monitor flag a forwarder as down even with it reporting inside of the 24 hour window, just to find the forwarder daemon was indeed down. Searching the specific host "host=" for "Last 24 hour" may shed some light as to what's going on. In my previous case, the server would be churning out a steady amount of logs, then just stop for a couple hours. There may be a parameter within the Deployment Monitor searches that detects this.

0 Karma