How to create a search to see what is currently forwarding logs to Splunk?

[heats]

We're going to be migrating our Splunk to a central instance. I need to start pulling some information which I think I could do in a report/search and my regex skills are brand new.

If I wanted to report on what's currently forwarding logs into our current Splunk instance, is there any documentation that would be helpful? Could someone point me in the right direction?

Thank you!

[somesoni2 · Accepted solution]

Here are few you can use

List of servers sending their internal data to your Indexers (all servers should send _internal data to Indexers). This may include your Splunk servers, so you can exclude them WHERE clause.

| tstats count WHERE index=_internal sourcetype=splunkd host=* by host | table host 

List of servers sending non-internal data

| tstats count WHERE index=* by host | table host

or

| metadata type=hosts index=* | table host

[heats]

AMAZING! Is the second one just all of the servers that have Splunk forwarder installed but aren't currently sending any data to Splunk?

[aaraneta_splunk]

@heats - Did the answer provided by somesoni2 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[somesoni2]

The first one will give list of all forwarders that have forwarder installed and is connecting to your Indexers. They may or may not have application logs monitoring enabled (not sending any data).

The second and third one shows list of forwarder which are actually sending some (application/machine) data to Splunk.