How to monitor deployed universal forwarders

[joshk2005]

We sporadically have had issues where the forwarder service stops working due to the need to clear locks on the client. Is there a good search string that we could use to alert off of when specific forwarders stop working? We are specifically looking to ensure that our domain controllers do not stop forwarding data (for long) due to the forwarder service not running.

[MuS]

Hi joshk2005,

check out the deployment monitor app https://apps.splunk.com/app/1294/ which includes such searches like missing forwarder and other stuff which can be useful. Also check out the S.o.S app https://apps.splunk.com/app/748/ or if you're using Splunk 6.2 have a look at the http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole

cheers, MuS

[trsavela]

Deployment monitor app is a great tool. There is even built in options to create alerts easily - great time saver.