Why is Splunk missing forwarder on endpoints alerts?

[mikefg]

I have a UF installed on an endpoint and plan to do more, but whenever the endpoint (laptop) is offline I get missing forwarder alerts from DMC. This will happen frequently since endpoints are shutdown for the night/weekend, offline for travel, in for repair/replacement, etc.

Is there any way to group forwarders in DMC and set alert thresholds or settings to get immediate and continuous alerts about some systems like servers, but not others like endpoints?

[richgalloway · Accepted solution]

The DMC doesn't have that functionality.  You can, however, clone the DMC alert and then modify the clone to alert only on server forwarders (using your name scheme or other method).  Then disable the original alert.

[mikefg]

I'll give this a try, thank you!