Splunk Enterprise

How will we be able to determine which of our 10,000 forwarders is down?

aemireddyshyam
Engager

How will we be able to determine which of our 10,000 forwarders is down?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You should use monitoring console and enable forwarder monitoring. Then you can just check which are down. 

Settings -> MC -> Forwarders -> Forwarders: Deployment. 

There is also alert: DMC Alert: Missing Forwarders which you could enable.

Another way is just install e.g. Meta Woot or TrackMe app and configure those to follow up your forwarders.

r. Ismo

Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...