Splunk Search
Highlighted

Run search to determine if forwarder has splunkweb enabled?

SplunkTrust
SplunkTrust

Is there a search string that would report on the status of splunkweb on each forwarding host?

Highlighted

Re: Run search to determine if forwarder has splunkweb enabled?

Splunk Employee
Splunk Employee

Not exactly. You could check for the existence and most recent time of a startup message in the Splunk internal web_service.log file, though a LWF may or may not forward that file. Though of course, a LWF shouldn't have SplunkWeb enabled at all.

index=_internal source=*web_service.log "ENGINE: Bus STARTED" | stats first(_time) by host
Highlighted

Re: Run search to determine if forwarder has splunkweb enabled?

SplunkTrust
SplunkTrust

It looks like you would have to set the forwarder to monitor the webservice.log, or otherwise forward the contents of the forwarders _internal index. As far as I can tell, searching as you suggested will only return information for the indexers webservice.log, unless I am missing something.

0 Karma