Query for Splunk Forwarder is active or not?

[sneha0924]

We have received an alert for splunk Forwarder not active on 1 host. We are not able go see the contributing events for this.

Could you please help me with the query to search whether splunk Forwarder is active or not?

[sneha0924]

Hi @gcusello  

Thanks for your response.

I want to debug  a forwarder that isn't sending logs. 

I Will follow the steps which you have provided and will update you.

Thanks

I will try an

[gcusello]

Hi @sneha0924,

Let me understand: do you want a search to have an alert when a forwarder is down or to debug this condition?

if you want an alert, you have to create a lookup (called e.g. perimeter.csv) containing all the hostnames to monitor in your perimeter, containing at least one column (host), and run a search like this:

| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

if instead you want to debug  a forwarder that isn't sending logs, you have to go in SSH on that machine and then: check the connection with telnet and see local Splunk logs to debug the problem.

Ciao.

Giuseppe