How to make a line chart that shows the up time of a forwarder?

[allen_edmondso1]

Hi,

We have a number of forwarders in our Splunk Enterprise. And I've been asked to chart the "uptime" of the forwarders in a monthly report. I've no idea how to do that.

I have made an alert to email me using the metadata command based on type=host if an index hasn't been received in the last 300 seconds. But I need a chart showing when it has been up or down...

Thanks
Allen

[adamsaul · Accepted solution]

allen_edmonson,

Have you taken a look at "Settings" then the "Monitoring Console"? Enabling Forwarder Monitor will allow you to build these reports pretty quickly.
Splunk Docs :: Set up Forwarder Monitoring

Adam

[adamsaul]

allenedmondson,

Glad it worked out for you!

[allenedmondson]

Thanks for your answers. I am not at work at the moment... so can't get the exact search. But it was based on one of the examples for the metadata command. @Somesoni2, can you give an example of the summery index data option? Say I am using only one index..
I will also look at the forwarder monitoring option when I get in to work....thanks.

[somesoni2]

When you use the metadata command, what index do you use? (or if you can provide your metadata command). One way would to be use a timechart command to see when there was an event appearing in (that) index from the host. This can be expensive based on which index is being used (how much data that index has). Other option would be setup a summary index to capture the trend/timechart data at frequent interval and chart based off summary index data (already summarized so will be optimal).

[somesoni2]

Some good readings are available here on summary indexing

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Usesummaryindexing
http://www.splunk.com/view/SP-CAAACZW (video)
https://wiki.splunk.com/Community:Summary_Indexing

[allenedmondson]

This is the search that generates the alert if I don't see anything in the last 5 minutes:

| metadata type=hosts index=Exchange | convert ctime(RecentTime) as recent_Time | where lastTime < (now() - 300) | convert timeformat="%d/%b/%Y %H:%M:%S" ctime(recentTime) | convert timeformat="%d/%b/%Y %H:%M:%S" ctime(lastTime) | convert timeformat="%d/%b/%Y %H:%M:%S" ctime(firstTime)

Thanks