1. Home
  2. Forwarder Awareness
  3. Forwarder Awareness – How Does It Work?

Forwarder Awareness – How Does It Work?

What is a missing forwarder?

A missing forwarder is a forwarder that does not check in for a certain amount of time. Atlas analyzes the environment every hour to check for forwarders & compares it to a running list of known forwarders. If a known Splunk forwarder doesn’t appear in this 15 minute chunk, then it is reported as a missing forwarder.

How to update the Known Forwarder’s list

Every hour the ‘Atlas Missing Forwarders Alert and Known Forwarder List’ Scheduled Search runs. This search investigates the current environment and identifies missing forwarders, automatically updating the Known Forwarder’s List.

If a user would want to manually update this list, they will need to hit the “Update Known Forwarders” button on the Forwarder Group Overview. This search may take time to update in larger environments.

Updated on December 17, 2021

Was this article helpful?

Related Articles