Install this app on your Heavy Forwarder, and optionally your search heads for search time knowledge objects.

If you do not run Splunk as root (which you shouldn't be) then configure your OS as per https://github.com/ValentinBELYN/icmplib/blob/main/docs/6-use-icmplib-without-privileges.md

Do not attempt to install or configure this input to collect data from Splunk Cloud. It will not work.

Configuration

Configuration via GUI is done at Settings > Data inputs > ICMP

Alternatively, create an inputs.conf that includes:

[icmp://<name>]
**file** = file path relative to the app that contains a CSV file with the headings target,asset,enabled
**concurrency** = How many sockets to try open at once
**timeout** = How long to wait for each socket to open
**interval** = How often to check all the targets

For example, the defaults are:

[icmp://example]
file = default/targets.csv
concurrency = 50
timeout = 2
interval = 300

Targets CSV file

target should be an IP address for best performance, to avoid doing repetitive DNS queries on every check.
asset is a free text field that alows you to add a human readable label for the thing your checking. This is where you would put the host name or similar.
enabled allows you to disable an entry without removing it from the list.

ICMP Modular Input

0