Splunk Enterprise

How will we be able to determine which of our 10,000 forwarders is down?

aemireddyshyam
Engager

How will we be able to determine which of our 10,000 forwarders is down?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You should use monitoring console and enable forwarder monitoring. Then you can just check which are down. 

Settings -> MC -> Forwarders -> Forwarders: Deployment. 

There is also alert: DMC Alert: Missing Forwarders which you could enable.

Another way is just install e.g. Meta Woot or TrackMe app and configure those to follow up your forwarders.

r. Ismo

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...