Splunk Search

IS there any script how we can check SPlunk agent is inactive in user server.

sahils
New Member

IS there any script or how we can check SPlunk agent is inactive in user server.
I received email or notification If SPlunk agent is not running on user servers.

Thanks,
Sahil

Tags (1)
0 Karma

sahils
New Member

Any update?

Thanks,
Sahil

0 Karma

lycollicott
Motivator

Do you maintain an up to date list of all the servers in your environment?

0 Karma

lycollicott
Motivator

You could write a script, but why don't you use the Monitoring Console? If you configured your Splunk to send emails then it can email you when a forwarder is missing, too.

Look at the bottom of this screen shot.

alt text

You can get started with the Monitoring Console here: https://docs.splunk.com/Documentation/Splunk/6.5.3/DMC/DMCoverview

sahils
New Member

Hello,

We are checking status in Deployment Server But If agent goes down We are not aware in which server or which application is impacted Is there any script , query or How we notify automatically tell us in Which server agent is down.

Thanks,
Sahil

0 Karma

lycollicott
Motivator

If the agent (UF) goes down then this will tell you it has stopped. That is what "missing" means.

0 Karma

andrey2007
Contributor

You can use Deployment server to manage agents(fowrwarders) which usually phoning home to deployemnet server
to know agent status you can use following search and configure alert for specific host

index=_internal (phonehome component=DC*) OR (component=DC:HandshakeReplyHandler) host=hostname
| sort _time
| table _time host log_level message

it is from https://answers.splunk.com/answers/208607/how-to-determine-if-forwarder-is-phoning-home-to-d.html

0 Karma

sahils
New Member

Thanks Andrey We are checking status in Deployment Server But If agent goes down We are not aware in which server or which application is impacted Is there any script , query or How we notify automatically tell us in Which server agent is down.

Regards,
Sahil

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can check if splunk is active by running splunk status on the CLI.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...