How to get list of Universal forwarders that are no longer sending logs

[koyachi]

Hi Folks,

We have thousands of universal forwarders that are currently running on old version (7.0.2). We are planning to upgrade universal forwarders to most recent version but before we do that we would like to reduce the overall footprint of universal forwarders by uninstalling them from the servers that are no longer sending logs.

 Logs for few applications and infrastructure are migrated to Azure so they are no longer sending it to splunk.

Need to find a list of such servers so i can uninstall them before i do mass upgrade. Is there a query that can give me the list of hostname along with timestamp of last log that it sent.

Thanks in advance

[PickleRick]

If you are using Forwarder Monitoring in the Monitoring Console, you can find all forwarders that were sending logs to your environment (from the last inventory reset point).

[gcusello]

Hi @koyachi,

you can list all the Forwarders that sent logs in a period (e.g. 90 days) and that don't send logs from 7 days using a search like the following

| tstats count latest(_time) AS latest WHERE earliest=-90d@d latest=now BY host
| where latest<now()-(86400*7)
| eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S")
| table host latest

Obviously, you can use the time periods you need in this search.

Ciao.

Giuseppe