Forwarder Groups are the building blocks for Atlas Forwarder Awareness, as they actively group together Forwarders to condense reporting and visualizations. Creating a Forwarder Group is easy, and should be the first step to enabling Forwarder Awareness to track your Forwarder infrastructure and reduce data flows interruptions. After creating a group, a group owner can then get notified of any missing Forwarders.
You must have Splunk admin permissions to follow these steps
Creating a Forward Group
On Atlas Forwarder Awareness's home page, Forwarder Groups Overview, select the Create New Group button in the top right.
A modal should appear. The modal will contain the following required fields to fill out:
Group Name: Give the group a title that can easily be tracked or identified. You can use this section to divide your Splunk data by business units, unique objectives, or by physical characteristics. For example, this can be "Security Data", "South Data Center", or "F&A Group".
Priority: Select an importance of the Forwarder Group.
Hosts: Search and select Forwarders to add (or remove) to the Forwarder Group.
Server Classes can be added to Forwarder Groups as well. This will enable Forwarder Groups to mirror Server Classes created and edited on the Deployment Server automatically. To get the Server Class option, the Deployment Search Head needs to be a Search Peer.
Description: Input a quick description of the Forwarders that will be monitored.
Contact: This is the 'Owner' of the data, and is the person that should be contacted in case of an outage.
Contact Info: This requires an email, and should be related to the Contact listed in the prior field. This email will be notified in the case of an outage.
All of these settings can be edited later. Select Save to create your Forwarder Group.
A Forwarder Group should now appear on the Forwarder Groups dashboard.
Editing a Forwarder Group
Select the information bubble in the bottom right of a Forwarder Group tile.
Admins can also reach this Edit Group modal from the appropriate Forwarder Group dashboard and selecting the Edit button at the top right.