Getting Data In

How to monitor deployed universal forwarders

Explorer

We sporadically have had issues where the forwarder service stops working due to the need to clear locks on the client. Is there a good search string that we could use to alert off of when specific forwarders stop working? We are specifically looking to ensure that our domain controllers do not stop forwarding data (for long) due to the forwarder service not running.

0 Karma

SplunkTrust
SplunkTrust

Hi joshk2005,

check out the deployment monitor app https://apps.splunk.com/app/1294/ which includes such searches like missing forwarder and other stuff which can be useful. Also check out the S.o.S app https://apps.splunk.com/app/748/ or if you're using Splunk 6.2 have a look at the http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole

cheers, MuS

Path Finder

Deployment monitor app is a great tool. There is even built in options to create alerts easily - great time saver.

0 Karma