The Forwarder Awareness component allows users to view forwarder data and status, including failures.
The “Forwarder Awareness” tab includes a list of forwarders by KB/s. These include details of instance, GUID, forwarder type, IP address, SSL enablement, Splunk version, operating system, time last connected, architecture, receiver count, connection count, average KB/s, and average events/s.
Below this list are graphs representing forwarders by operating system, forwarder types in use, and forwarders’ SSL status. Below the graphs is a list of top forwarders by total MB and then a table of missing forwarders.
These graphs and the corresponding table of forwarders above can be filtered by time range, forwarder type, and keyword search. The user can also choose to ignore hosts forwarding only internal logs by checking the corresponding box.
Clicking on the “Forwarder Awareness Search” will open a new tab.
This tab contains searches, reports, and alerts regarding forwarder activity. They can be edited and run from this page. Users can also create a new report or a new alert from this page. To learn more about working with forwarder searches, click here.