Splunk Search

IS there any script how we can check SPlunk agent is inactive in user server.

sahils
New Member

IS there any script or how we can check SPlunk agent is inactive in user server.
I received email or notification If SPlunk agent is not running on user servers.

Thanks,
Sahil

Tags (1)
0 Karma

sahils
New Member

Any update?

Thanks,
Sahil

0 Karma

lycollicott
Motivator

Do you maintain an up to date list of all the servers in your environment?

0 Karma

lycollicott
Motivator

You could write a script, but why don't you use the Monitoring Console? If you configured your Splunk to send emails then it can email you when a forwarder is missing, too.

Look at the bottom of this screen shot.

alt text

You can get started with the Monitoring Console here: https://docs.splunk.com/Documentation/Splunk/6.5.3/DMC/DMCoverview

sahils
New Member

Hello,

We are checking status in Deployment Server But If agent goes down We are not aware in which server or which application is impacted Is there any script , query or How we notify automatically tell us in Which server agent is down.

Thanks,
Sahil

0 Karma

lycollicott
Motivator

If the agent (UF) goes down then this will tell you it has stopped. That is what "missing" means.

0 Karma

andrey2007
Contributor

You can use Deployment server to manage agents(fowrwarders) which usually phoning home to deployemnet server
to know agent status you can use following search and configure alert for specific host

index=_internal (phonehome component=DC*) OR (component=DC:HandshakeReplyHandler) host=hostname
| sort _time
| table _time host log_level message

it is from https://answers.splunk.com/answers/208607/how-to-determine-if-forwarder-is-phoning-home-to-d.html

0 Karma

sahils
New Member

Thanks Andrey We are checking status in Deployment Server But If agent goes down We are not aware in which server or which application is impacted Is there any script , query or How we notify automatically tell us in Which server agent is down.

Regards,
Sahil

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can check if splunk is active by running splunk status on the CLI.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...