Splunk Enterprise

How will we be able to determine which of our 10,000 forwarders is down?

aemireddyshyam
Engager

How will we be able to determine which of our 10,000 forwarders is down?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You should use monitoring console and enable forwarder monitoring. Then you can just check which are down. 

Settings -> MC -> Forwarders -> Forwarders: Deployment. 

There is also alert: DMC Alert: Missing Forwarders which you could enable.

Another way is just install e.g. Meta Woot or TrackMe app and configure those to follow up your forwarders.

r. Ismo

Get Updates on the Splunk Community!

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...