Splunk Search

Adding Servers monitored by Splunk

dina_vaghjiani
New Member

We are going through the process of adding more servers to our fleet and monitor them with splunk.
1. Does anyone know an easy way of grabbing a list of all the servers which currently report into splunk?
2. And does anyone know how I can configure a server to report to a newly added splunk server?

Many Thanks

[edited title]

Tags (3)
0 Karma

yannK
Splunk Employee
Splunk Employee

It depends of what you want to do :

  • to get the list of the monitored hosts, do a search on the host
  • get the list of your existing forwarders, enable the "Deployment Monitor" app and look at the reports of the forwarders
  • to add new indexers, and load balance your data between all your indexers :

Here is the classic procedure to add a new indexer to the cluster.

On the new indexer,

  • define all the indexes,
  • setup all the props/transforms required for the indexing of your sourcetypes.
  • open the listening ports (splunktcp 9997 by example)
  • List item

On the search-head,

  • add the new indexer as a search-peer (manager > distributed search)

On each forwarders :

0 Karma

dina_vaghjiani
New Member

Hi I mean "sending logs". We have a number of servers whose log files we can analyse via splunk, I want to know the full list of which servers and how to add a server.

0 Karma

bmacias84
Champion

@dina_vaghjiani, Are you looking for getting your new splunk server or forwarders to "report into" a Deployment server or licensing server.

0 Karma

Ayn
Legend

Define "report into" - do you mean that they're sending logs, or that they're deployment clients, or a bit of both?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...