Is there an SPL query to know the last date UFs phoned in to a specific DS?

[So76]

Is there an SPL query to know the last date  UFs phoned in to a specific DS. We've many DS in our company

[gcusello]

Hi @So76,

you can use the search from @Roy_9 that's correct or to use the Monitoring Console that gives you all the information about Forwarders, not only last phoned date.

Ciao.

Giuseppe

[Roy_9]

below search  gives you the list of UF's that haven't phoned in last 24 hours, you could tweak this search.

| rest splunk_server=local /services/deployment/server/clients | eval now=now(), diffTime=now-lastPhoneHomeTime, lastPhoneHomeTime=strftime(lastPhoneHomeTime,"%b %d, %Y %H:%M:%S") | search diffTime>86400 | table hostname ip instanceName utsname package splunkVersion lastPhoneHomeTime

[So76]

Thanks for you prompt response. Can it be narrowed to a specific DS? We've multiple DS

[gcusello]

Hi @So76,

for this reasono, Monitoring Console is the easiest way.

Ciao.

Giuseppe

[gcusello]

Hi @So76 ,

if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors;-)

[So76]

used the monitoring console