Network Toolkit: Installation on Splunk Forwarders

[rahuljassal]

Hi @LukeMurphey 

Is is possible to install the network toolkit app on a UF ? We have too many servers that we want to run a ping test against. But with Splunk SaaS, it wont be possible to do so from cloud.

Thanks

R

[dzagadsky]

I have the same question. I'm looking specifically to have the scheduled ping and speedtests run on forwarders and then phone home with the data. For example when remote users complain of slow speeds on VPN it's nice to have a historical record of "normal".

The existing app runs the ping and traceroute and other tests from the search head. If you want to see the same information but from the perspective of selected forwarders, it makes sense to just run the python scripts that collect the data and then forward the output to an indexer.

It doesn't seem like the app works on a universal forwarder in its current state- forgot about the lack of python built into the forwarder. I'm going to try on a computer with python installed to see what happens.

[richgalloway]

The Network Toolkit app defines dashboards and custom search commands so it needs to be installed on your search head(s). Installing it on a UF, even if possible, is of little to no utility.
Consider installing an on-prem heavy forwarder and installing the app there. Use the HF only for your ping tests.