Splunk Enterprise

How will we be able to determine which of our 10,000 forwarders is down?

aemireddyshyam
Engager

How will we be able to determine which of our 10,000 forwarders is down?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You should use monitoring console and enable forwarder monitoring. Then you can just check which are down. 

Settings -> MC -> Forwarders -> Forwarders: Deployment. 

There is also alert: DMC Alert: Missing Forwarders which you could enable.

Another way is just install e.g. Meta Woot or TrackMe app and configure those to follow up your forwarders.

r. Ismo

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...