We have received an alert for splunk Forwarder not active on 1 host. We are not able go see the contributing events for this.
Could you please help me with the query to search whether splunk Forwarder is active or not?
Hi @gcusello
Thanks for your response.
I want to debug a forwarder that isn't sending logs.
I Will follow the steps which you have provided and will update you.
Thanks
I will try an
Hi @sneha0924,
Let me understand: do you want a search to have an alert when a forwarder is down or to debug this condition?
if you want an alert, you have to create a lookup (called e.g. perimeter.csv) containing all the hostnames to monitor in your perimeter, containing at least one column (host), and run a search like this:
| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0
if instead you want to debug a forwarder that isn't sending logs, you have to go in SSH on that machine and then: check the connection with telnet and see local Splunk logs to debug the problem.
Ciao.
Giuseppe