Some of our team has been looking through the SOS topology view, and when we use the status overlay, some of the servers show up as black. Some of them do not report in to splunk if we do searches for those hosts, but some of them are reporting in within the last 24 hours. Is there a specific criteria that splunk looks for when it overlays the status on the topology page? Thank you
As far as forwarders are concerned, the status overlay on the S.o.S topology view has 3 states:
As far as forwarders are concerned, the status overlay on the S.o.S topology view has 3 states: