How to validate Splunk forwarder status?

[nbteal]

Our organization currently hosts a "Splunk Health" dashboard. This dashboard has a panel that shows the heartbeat interval and overdue status of all the known splunk forwarders. However, what this dashboard does not have is a panel that can identify any valid endpoint on network that does not have the splunk forwarder installed.

Problem Statement: Add panel to dashboard that depicts any valid endpoint without Splunk forwarder installed.

I am fairly new to splunk. However, I thought that the best way to tackle would be to pull a csv from AD of all valid endpoints (WS, Servers, etc) and host as a lookup table file within Splunk. Then identify a query that compare current "clients" in Forwarder Management against the new lookup table file (AD output). The results would show me any endpoint that is not currently a client within Forwarder Management.

Any help would be appreciated. Thank you.

[gcusello]

Hi @nbteal,

you are asking an Asset Discovery feature, but Splunk, by itself, cannot monitor devices not connected with it.

Asset dispovery is usually done by Vulnerability Assessment or CMDB systems, not using a log management system.

But you could use this apphttps://apps.splunk.com/app/662/ that perform a scan on your network (using scripts) identifying all the object on your network and executing a compare with the monitored systems.

Ciao.

Giuseppe

[nbteal]

@gcusello 

Thank you for the information. Was tracking splunk cant monitor systems that arent connected to the server. Was hoping it may be able to perform a compare against a lookup file and known "clients/forwarders".

I'll take a look at the app you suggested.

Thank you again for your time and have a nice day.

[gcusello]

Hi @nbteal,

yes, it's a best practice to implement always a check between the perimeter to monitor (usually a lookup) and the connected systems to immediately identify eventual missing systems.

Ciao.

Giuseppe