Hi @max_ruas, sorry but I don't know a search to have this, also becasue you cannor run a search not aving logs in Splunk. You could run a search like the one I hinted and then, if there are results, use telnet to check if there's some block. Probably the best approach is that in your installation procedure (you surely have one!) you could add as first step a connection check using telnet. If you haven't it, create a new one! Remember to check both connection with: the Deployment Server on port 8089, the Indexers on port 9997. Ciao. Giuseppe ... View more

I've found a solution on the forwarder app it self. on linux is under cat /opt/splunkforwarder/bin/scripts/readme.txt Scripts placed in this directory can be called by Alerts for execution if you define your scheduled search as an alert, you can configure a script to be run whenever the alert is triggered. For security reasons, the scripts need to be placed in a specific folder like the above. http://docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Setupalertactions#Run_a_script_for_an_alert_action ... View more

To determine when it last came up I’d try a search like- index=_internal source=*splunkd.log* “my guid is” . I’d investigate how tivali is monitoring your Splunk Instance in question. For example is it dependent on network and server availability of tivali itself. Also I would investigate changes like patches that may have impacted you. If you have Splunk support available run a diag command and open a case. It is very hard to just spitball what your specific issue may be. http://docs.splunk.com/Documentation/Splunk/7.0.0/Troubleshooting/Generateadiag ... View more

Click Accept on your answer to close the question. ... View more