Getting Data In

Network Toolkit: Installation on Splunk Forwarders

New Member

Hi @LukeMurphey 

Is is possible to install the network toolkit app on a UF ? We have too many servers that we want to run a ping test against. But with Splunk SaaS, it wont be possible to do so from cloud.




Labels (2)
Tags (1)
0 Karma


I have the same question. I'm looking specifically to have the scheduled ping and speedtests run on forwarders and then phone home with the data. For example when remote users complain of slow speeds on VPN it's nice to have a historical record of "normal".

The existing app runs the ping and traceroute and other tests from the search head. If you want to see the same information but from the perspective of selected forwarders, it makes sense to just run the python scripts that collect the data and then forward the output to an indexer.

It doesn't seem like the app works on a universal forwarder in its current state- forgot about the lack of python built into the forwarder. I'm going to try on a computer with python installed to see what happens.

0 Karma

The Network Toolkit app defines dashboards and custom search commands so it needs to be installed on your search head(s). Installing it on a UF, even if possible, is of little to no utility.
Consider installing an on-prem heavy forwarder and installing the app there. Use the HF only for your ping tests.
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...