Hi there,
How would I set up a table to find out which forwarders have not phoned home in the last day ? I am currently using this REST search for other related activity:
-index=_internal group=tcpin_connections | join hostname [| rest /services/deployment/server/clients splunk_server=* | eval lastPhoneHome=tostring(now()-lastPhoneHomeTime,"duration")
Thanks!
↧