Back to Floor
The Data Pipeline • Room 4
🖥️ SPL Lab: Monitoring Forwarder Status
As an admin, you need to monitor whether your forwarders are sending data. The _internal index and the Monitoring Console are your best friends for this.
You can search the _internal index for metrics from forwarders to check their connection status, data throughput, and last contact time.
The "splunk_tcpin" sourcetype in _internal shows incoming forwarder connections on your indexer.
Knowledge Check
Prove your understanding to clear the room (Rewards XP)
Write a search that shows all connected forwarders with their latest contact time using _internal.
Splunk Search Bar
>