The Forwarder Awareness component allows users to view forwarder data and status, including failures.
The first page of Forwarder Awareness is the Forwarder Group Overview. On this Dashboard, Admins can create Forwarder Groups that coalesce forwarders together with context and ownership. Selecting a Forwarder Group leads users to the Forwarder Awareness dashboard.
The “Forwarder Awareness” tab includes a list of forwarders by KB/s. These include details of instance, GUID, forwarder type, IP address, SSL enablement, Splunk version, operating system, time last connected, architecture, receiver count, connection count, average KB/s, and average events/s.
Users can select a Forwarder in the Forwarder Inventory to view additional information related to its ingest and Source Types.
Clicking on the “Forwarder Awareness Search” will open a new tab.
This tab contains searches, reports, and alerts regarding forwarder activity. They can be edited and run from this page. Users can also create a new report or a new alert from this page. To learn more about working with forwarder searches, click here.