Since TAs run in the background & usually not viewed, how do I check on their health? Any useful SPLs are appreciated.
What do you mean by "TA-s run in background"?
TA-s on its own don't "run". They might provide some scripted/modular inputs and then you might simply monitor the destination indexes, but often they just contain props/transforms/lookups.
Thank u for your response. Am familiar with TAs function. What I mean is they are not visible like apps that do a certain function. So we download TA like we do with Apps. What am looking for is a SPL to tell me if a TA is broken or did not install properly & not doing it's duty. Please advise.
How would you like to decide (especially without knowing details of particular TA) whether it's doing its job or not?
For example - you install a TA for windows but misconfigure the inputs on your UF-s and they send the data with wrong sourcetype so no props/transforms from said TA are applied in searchtime because they don't catch the events. How would you like to detect that?