Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Health Check of Servers after patching
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Health Check of Servers after patching
Hi ,
I want to ask community how you do health check of servers after patching? Is there any automation you have build in order to identify if server health check is good after patching activity for multiple server in one shot? Using any tool to identify or any query build up or any dashboard to enter the server details and get stats?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's not clear if you are speaking about patching Splunk application servers or just other servers in your environment. Any server hosting a Splunk function will report into the DMC and that should be your source of truth about how the Splunk application is functioning after a server patch.
Other servers in your environment should be monitored based upon your own desires and concepts of critical functions. It really lays outside the topics on this community answer board.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First of all sorry i am not clear about the servers. These are syslogs servers which we patch and we have list of server to validate if these are working perfectly fine post patching activity or not. Do you know or suggest what all things we can validate in one by creating any dashboard or some other type of automation?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well, if the servers themselves work OK - that's the task for the infrastructure team. They should have tools for that (or at least the knowledge what and how should be checked). You can discuss with them if Splunk can be helpful in this process but of course you'd need some data ingested from the relevant hosts.
If you just want to check if the servers send data which is ultimately ingested into splunk, there are several apps for that on Splunkbase, for example TrackMe.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for an answer however i am looking for generic solution and don't want to using any App.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
1. There is no such thing as "generic solution" to a very broadly specified problem. It's as if you asked "how to make people happy? I want a generic solution". If you have a specific problem, we can try to help you find a specific solution.
2. If you don't want to use any ready-made apps, you have to implement such functionality yourself. Have a list of sources/hosts (either build it dynamically when your environment is running or create it from external data - for example export from your CMDB) and repeatedy verify if you have recent events ingested from those sources and hosts. That's it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, This is what i am planing to do so. Thanks for the input.
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
Customer success is front and center at .conf25
