Getting Data In

list host, source by forwarder

dominiquevocat
Motivator

How do i get a list comprising the fields host, source for each forwarder.

Background: the admins of the machines where the forwarder runs on seem to have made mistakes when adding a monitor and i would like to identify which ones are wrong and provide a clearing list.
The field that is wrong is unfortunately "host". By identifying which "host,source" by forwarder i can tell which forwarder needs to be corrected.

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi dominiquevocat,

because it is fun to play around in Splunk and always look for other ways to get the results, try this:

 index=_internal ( source=*license_usage.log type!=*Summary ) OR ( source=*metrics.log group=tcpin_connections fwdType=uf ) | streamstats last(sourceIp) AS last_ip last(hostname) AS last_hostname | where h=last_hostname | stats values(last_ip) AS IP values(st) AS sourcetype values(s) AS source by h | rename h AS Host

This will give you a nice table view of each Hosts Name, IP used, sourcetype used and sources used.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

HeHe, try to limit the base search by using snippets of the source name or ip or hostname 😉

0 Karma

dominiquevocat
Motivator

looks nice! perhaps due to the large amount of files on one of the hosts it stops after some 30'000 or so sources...

0 Karma

strive
Influencer

Try this

|metasearch host=* | dedup source | table host, source
0 Karma

dominiquevocat
Motivator

nope, because the value in "host" is the wrong one (overridden value) and i need to ip or hostname of the forwarder where this came from.

0 Karma

strive
Influencer

Ok. In any case, the above search in my comment should work. are you seeing any issues with the search?

0 Karma

dominiquevocat
Motivator

i have reason to suspect, that the guy indexing files specified the host when doing "add monitor" on the command line.

0 Karma

strive
Influencer

Are you configuring what should be host in inputs.conf? If not the host name set on the device will be taken automatically.

0 Karma

strive
Influencer

The above search should work for your needs. In case if you need splunk server details also then do this

|metasearch host=* | dedup source | table host, source, splunk_server

0 Karma

dominiquevocat
Motivator

I updated the question, sorry. The field that is wrong is "host"...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...