This is good discussion.
Most of the customer demands a report for server Availability.
We perform following things:
Is there any other method people use? Please suggest.
As said above... if you're simply trying to see if a UF is up and communicating, here is a quick query to see how long it's been since a UF has communicated with Splunk.
| metadata type=hosts index=_internal | eval min_last_comm = now()-recentTime | eval min_last_comm = round(min_last_comm / 60) | eval _time=now() | fields _time, host, min_last_comm
If you have forwarders installed on all your endpoints, the options are almost endless, but it depends exactly 'what' you are trying to monitor.
If you just want to see which machines are online and connected to Splunk, you can use the
metadata command to quickly produce a list of systems which have communicated in the last x minutes.
| metadata type=hosts index=_*
By specifying index=_* it checks the internal logs (rather than your monitored data sources)
If you are looking to verify that the hosts have network connectivity to/from a specific location (you know they have net-access to Splunk because otherwise there wouldn't be any logs) you can write a simple script which executes
ping from each host and indexes the results.
If you are looking to more accurately track, and report on network performance, you should use the metrics store to collect metric and performance data from each host, and build your own charts with the metrics workspace.
If you want the most powerful insight into your networking/host and performance data, take a look at Splunk ITSI
I have splunk universal forwarder installed on all servers. Which parameter I need to use for ping monitoring for both windows and unix?