Getting Data In

Search to find when a forwarder restarted?



Is there a search that I can run that shows when a forwarder starts, and is considered up and running? I want to create transactions - one that shows it starts and is running, and another that shows it started but isn't running (and therefore some errors may exist).

0 Karma


There are messages in the internal logs, _*.

index =_*  host=<fwd name> starting

Even better is the deployment app, look for all kinds of things and is easy to setup alerts.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...