Splunk Search

How to write a search to display forwarders missing at a certain point in time?

AaronMoorcroft
Communicator

Hi Guys

Is there a search that can pull back the forwarders that are missing / not sending data at a point in time, so if 100 were reporting in yesterday, I'm after a report that looks at what's sending logs now and compare to what was sending in at the same time yesterday and display the missing forwarders at this point in time.

I hope that makes sense.

Thanks

Tags (3)

skoelpin
SplunkTrust
SplunkTrust

Try this

index=_internal sourcetype=splunkd destPort!="-"| stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - count
0 Karma

AaronMoorcroft
Communicator

Hey, thank you.

That's not quite what I need but it will help me with a different task I have so thank you 🙂

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...