Solved: where can i see in the splunk internal logs when a...

pavanae · ‎10-04-2016

Is there any specific search that i can pull out the connection established time and date?

inventsekar · ‎10-04-2016

Tcp_connection group event will be written to _internal index, when a UF connects to an indexer.
List of Forwarders that have connected in the last 3 minutes:

index=_internal group="tcpin_connections" startminutesago=3 | stats count(sourceHost) by sourceHost

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

inventsekar · ‎10-04-2016

Tcp_connection group event will be written to _internal index, when a UF connects to an indexer.
List of Forwarders that have connected in the last 3 minutes:

index=_internal group="tcpin_connections" startminutesago=3 | stats count(sourceHost) by sourceHost

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

where can i see in the splunk internal logs when a forwarder successfully started forwarding the data?

Index This | When is October more than just the tenth month?

Observe and Secure All Apps with Splunk

What’s New & Next in Splunk SOAR

Are you a member of the Splunk Community?

where can i see in the splunk internal logs when a forwarder successfully started forwarding the data?

Index This | When is October more than just the tenth month?

Observe and Secure All Apps with Splunk

What’s New & Next in Splunk SOAR