Splunk UF Fleet Monitoring — Every Forwarding Agent, at Any Fleet Size

An agent is connected when a Splunk receiver saw it within the connected window. The receivers describe the whole fleet, whatever its size — no heartbeat to deploy, no agent polled, nothing installed.

A network cut, a receiver tier down, a bad outputs push: one Mass disconnect finding on the fleet or on the group says it, and the agents' own findings are held — never a flood of one alert per agent.

Output blocked, destinations failing, throughput throttled, restart loops, input errors, cloned identities, version drift and unsupported versions, expected agents missing, fleet coverage, and the health of every Deployment Server.

Group agents by Deployment Server, server class, host name pattern, output group or lookup value — TrackMe proposes groups from what it sees — and carry your CMDB fields onto every agent and its findings.

Name the agents that must never drop, by name, pattern or lookup: an expected agent that is missing opens a finding, even during a mass event.

Clients, the phonehome pace against the usual, failing app deployments, the restarts asked for, refused requests and answer time — per Deployment Server, from the indexes it already writes.

The Splunk UF Fleet AI Agent reviews open findings from the facts TrackMe holds, classifies true and false positives, and recommends or applies the triage the tenant allows.