Getting Data In

How to determine if forwarder is phoning home to deployment server

dolfantimmy
Path Finder

What is the easiest way to determine if a specific forwarder is phoning home to the deployment server?

anakor
Engager

How to check the list of Universal Forwarders in the CLI of the Deployment Server? (Splunk versions 6/7)

0 Karma

lguinn2
Legend

I like @chanfoli's answer, but you can also do this:

Splunk 6: Is the deployment client phoning home?

index=_internal (*phonehome* component=DC*) OR (component=DC:HandshakeReplyHandler) host=hostname
| sort _time
| table _time host log_level message

In Splunk 5, the Splunk internal log format was a bit different. You could also use a similar search to identify clients that were phoning home yesterday, but have not phoned home today:

index=_internal (*phonehome* component=DC*) OR (component=DC:HandshakeReplyHandler) earliest=-2d
| eval Day=if(_time>(now()-86400),"Today","Yesterday")
| chart count by host day
| where Yesterday>0 AND Today<0

chanfoli
Builder

Via splunk web on the deployment server. Go to settings->forwarder management, select the clients and type in part of the hostname in the filter text box. If it is phoning home it should show up there with app count and time since last phone-home.

dolfantimmy
Path Finder

Thank you for your response. However, when on the web ui on the deployment server, I see no "settings->forwarder management"

0 Karma

dolfantimmy
Path Finder

I should note, this is version 5.0.1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...