Getting Data In

Query for Splunk Forwarder is active or not?


We have received an alert for splunk Forwarder not active on 1 host. We are not able go see the contributing events for this.

Could you please help me with the query to search whether splunk Forwarder is active or not?

0 Karma


Hi @gcusello  

Thanks for your response.

I want to debug  a forwarder that isn't sending logs. 

I Will follow the steps which you have provided and will update you.


I will try an

0 Karma


Hi @sneha0924,

Let me understand: do you want a search to have an alert when a forwarder is down or to debug this condition?

if you want an alert, you have to create a lookup (called e.g. perimeter.csv) containing all the hostnames to monitor in your perimeter, containing at least one column (host), and run a search like this:

| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

if instead you want to debug  a forwarder that isn't sending logs, you have to go in SSH on that machine and then: check the connection with telnet and see local Splunk logs to debug the problem.



0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.