Getting Data In

Search to find when a forwarder restarted?



Is there a search that I can run that shows when a forwarder starts, and is considered up and running? I want to create transactions - one that shows it starts and is running, and another that shows it started but isn't running (and therefore some errors may exist).

0 Karma


There are messages in the internal logs, _*.

index =_*  host=<fwd name> starting

Even better is the deployment app, look for all kinds of things and is easy to setup alerts.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...