UF status was not connected dashboard

[sekhar463]

Hi All,

we are working on to create a dashboard on UF status connection by using phone home interval in DS using search below

but while checking if forwarder phone connection last few secs in DS still it was showing as not connected in list.

please let us know what needs to be changes in the search to get exact result and also search was running slowly.

index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d
| eval Host=coalesce(hostname, sourceHost)
| eval age=(now()-_time)
| stats
min(age) AS age
max(_time) AS LastTime
BY Host
| convert ctime(LastTime) AS "Last Active On"
| eval Status=if(age< 1800,"Running","DOWN")
| rename age AS Age
| eval Age=tostring(Age,"duration")
| sort Status
| dedup Host
| table Host Status Age "Last Active On",
| where Status="DOWN"

[Jawahir]

In Monitoring Console you can see the forwarder status. There is an in built dashboard available for it.  

Refer for more info about the built in alert/reports: Configure forwarder monitoring for the Monitoring Console

[gcusello]

Hi @sekhar463,

to display forwarders' status I usually use a lookup (called e.g. perimer.csv) containing the Forwarders to monitor (eventually updated using a script) in a field called host and running a search like this:

| tstats count WHERE index=_internal BY host
| eval host=lower(host)
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Missing","Present")
| table host status

 Ciao.

Giuseppe