Monitoring Splunk

Need some direction reg. how to check if a Forwarder SW is healthy or not. Please read below & Thank u very much.

SamHTexas
Builder

I currently use the monitoring console to tell me if a Forwarder has not reported in the last 15 min & I consider that FW gone plus I check the list of decommissioned Hosts to consider a FW + Host gone for good! Well, what if the FW software has an issue & the host is just fine? Is there a SPL or way to tell if the Forwarder agent / SW is broken, so I can at least troubleshoot or re-install the FW? Thank u for your help in advance.

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Or it could be a network problem and both the host and UF are fine.  How would you determine that?  Unfortunately, as good as Splunk is it can't answer all questions or solve all problems.  Sometimes you have to revert to old-fashioned IT grunt work - log in to the box, call someone who can log in to the box, ask the network team if there's a problem, etc.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Or it could be a network problem and both the host and UF are fine.  How would you determine that?  Unfortunately, as good as Splunk is it can't answer all questions or solve all problems.  Sometimes you have to revert to old-fashioned IT grunt work - log in to the box, call someone who can log in to the box, ask the network team if there's a problem, etc.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...