Is there a way to get a list of heavy forwarders via rest?

[a212830]

Hi,

Is there a way to get a list of heavy forwarders via REST? We are creating our own HFW health page, since the DMC doesn't support it.

[koshyk]

Also, i've requested for Heavy Forwarders to be part of DMC: https://answers.splunk.com/answers/377028/how-to-configure-dmc-for-heavy-forwarder-monitorin.html

[lycollicott]

You could try this if all of your heavies follow a consistent naming convention:
| rest splunk_server=*hf* /services/server/introspection/indexer

Or this if you define a custom group:

| rest splunk_server_group=* splunk_server_group=* /services/search/distributed/peers 
| search search_groups=dmc_customgroup_Heavy_Forwarder
| table search_groups, server_roles, host

[coltwanger]

Do you need to use REST?

 index=_internal source=*metrics.log group=tcpin_connections 
 | eval sourceHost=if(isnull(hostname), sourceHost,hostname) 
 | rename connectionType as connectType
 | eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
 | eval version=if(isnull(version),"pre 4.2",version)
 | rename version as Ver 
 | fields connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver
 | eval Indexer= splunk_server
 | eval Hour=relative_time(_time,"@h")
 | stats avg(tcp_KBps) sum(tcp_eps) sum(tcp_Kprocessed) sum(kb) by Hour connectType sourceIp sourceHost destPort Indexer Ver
 | fieldformat Hour=strftime(Hour,"%x %H")

https://answers.splunk.com/answers/73908/listing-forwarders.html

[sloshburch]

I think this might be the best answer right now since I'm not confident that the Monitoring Console's server roles are exposed for filtering...

[lycollicott]

Change your first line to this: index=_internal source=*metrics.log group=tcpin_connections fwdType="full"

If you don't specify fwdType="full" you will get all the universal forwarders listed too.