How to check the forwarders/host which is not sending data?

[sekhar463]

Hai ,

Is there any way to check Splunk forwarder even HF/UF stops sending data to Splunk cloud?

[isoutamo]

If you want to know more detailed level and get alarms etc, there are several apps on splunk base. Here is link to TrackMe https://preview.splunkbase.splunk.com/app/4621

r. Ismo

[Roy_9]

@sekhar463  I guess you could use the below search:

| tstats latest(_time) as latest where index=* earliest=-24h by host
| eval recent = if(latest > relative_time(now(),"-5m"),1,0), realLatest = strftime(latest,"%c")
| where recent=0

You could also configure the Track me app available in splunkbase which has got good capabilities.

Thanks

[richgalloway]

Have you tried the Forwarder Monitoring feature of the Monitoring Console?

[sekhar463]

any process on Forwarder Monitoring feature of the Monitoring Console?

we need to enable it or it will by default

[richgalloway]

Forwarder monitoring must be enabled.  From he MC select Settings->Forwarder Monitoring Setup.