Splunk Enterprise

Why is Splunk missing forwarder on endpoints alerts?

mikefg
Communicator

I have a UF installed on an endpoint and plan to do more, but whenever the endpoint (laptop) is offline I get missing forwarder alerts from DMC. This will happen frequently since endpoints are shutdown for the night/weekend, offline for travel, in for repair/replacement, etc.

Is there any way to group forwarders in DMC and set alert thresholds or settings to get immediate and continuous alerts about some systems like servers, but not others like endpoints?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The DMC doesn't have that functionality.  You can, however, clone the DMC alert and then modify the clone to alert only on server forwarders (using your name scheme or other method).  Then disable the original alert.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The DMC doesn't have that functionality.  You can, however, clone the DMC alert and then modify the clone to alert only on server forwarders (using your name scheme or other method).  Then disable the original alert.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mikefg
Communicator

I'll give this a try, thank you!

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...