Forwarder Health

The Forwarder Health app provides the Splunk admin a view into issues relating to the health of their universal and heavy forwarders. There are a few great apps on Splunkbase designed to give admins a view into the state and health of their search heads and indexers (ie SoS, fire brigade, etc) but there really isn't anything to address the forwarders. The simple but effective method chosen and highlighted within the context of this app is to compare the volume of internal events from any particular forwarder to the average. If the volume is over the average it might be worth looking at, if the volume is dramatically over the average it is definitely worth looking at. Additional views include looking at field descriptor and throughput limits being hit, duplicate GUIDs, and the version distribution and log volumes being generated by your agents.