Splunk Enterprise

How will we be able to determine which of our 10,000 forwarders is down?

aemireddyshyam
Engager

How will we be able to determine which of our 10,000 forwarders is down?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You should use monitoring console and enable forwarder monitoring. Then you can just check which are down. 

Settings -> MC -> Forwarders -> Forwarders: Deployment. 

There is also alert: DMC Alert: Missing Forwarders which you could enable.

Another way is just install e.g. Meta Woot or TrackMe app and configure those to follow up your forwarders.

r. Ismo

Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...