Search for client disconnects from Indexer?

[splunktrainingu]

Is there a way to monitor disconnects on a host (with a deployed universal forwarder) that cannot reach the Indexer? We have an on prem solution. Simply trying to use this host to monitor if network A can reach network B because the host is in Network A and the index is in network B. 

[richgalloway]

If the host cannot reach the indexer then there will be nothing logged on the indexer to monitor.  The UF will log any failures to connect so that is the place to check, but you will have to do that on the host rather than in Splunk.

[splunktrainingu]

Would this be logged into the metrics log on the UF? I could monitor for no logs, I have done that in the past. 

[richgalloway]

The UF will log communication failures in splunkd.log.

Yes, you can monitor the indexers for no logs from hosts.  There are apps, including TrackMe, that can help with that.

[splunktrainingu]

So there is no way to monitor the splunkd.log on the UF from the Splunk Indexer?

[richgalloway · Accepted solution]

Normally, the UF is monitored from the indexers, but if the UF cannot connect to the indexer it cannot send its logs so there's no data to monitor.