Splunk search to check forwarder status based on last connected time

[sekhar463]

Hi Team,

i am using this search to check the status of UF"down based on last connection time.

but when i am removing the server from deployment server ,still this search output showing the server in down status, it should not visible in splunk search.

need suggestion on this to get exact output for down status

[cklunck]

---

@sekhar463 wrote:

but when i am removing the server from deployment server ,still this search output showing the server in down status, it should not visible in splunk search.

When you say you're "removing the server from the deployment server", what action specifically are you taking?

If a host appears even just once in the metrics log during the time range you're searching, then it will be included in your result set. If the time it was last seen is older than 7200 seconds, it will be marked as DOWN. Only if your search does not find any results for a host in the metrics log will that host disappear from the result set.

[isoutamo]

Hi

if you want to keep track on only some UFs on your environment, you should add those to lookup file. Then exclude all other nodes, which you found from internal logs. Of course you must update that lookup every time you manage your UFs.

How this has done? You could found quite many examples from community by google search.

r. Ismo