Getting Data In

Without have access to the universal forwarder, can I check whether it is sending data to the heavy forwarder?

Sharmarohit1234
New Member

Hi All,

I am relatively new to Splunk, In my environment we are using deployment server to manage the deployment apps on universal forwarders.

During the installation of universal forwarders, we specify the deployment server in deployment.conf.

But we have not mentioned anything about forwarding the data to the heavy forwarder (HF).

On the web interface of our heavy forwarders, under forwarding and receiving, I cannot see any configuration set up.

How can I check whether universal forwarders are sending data to HF? Are indexers or data getting managed by the deployment server?

I don't have access to the universal forwarders as these are managed by some different team.

So I have to check the configuration within the HF, Indexer or deployment servers.

Regards
Rohit

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @Sharmarohit1234,

You can use below query to check which servers (Universal Forwarders, Heavy Forwarders, Search Heads OR any other Splunk servers) are sending data to Indexers.

index=_internal host=INDEXER_SERVERNAME source=*metrics.log* group=tcpin_connections | dedup hostname | table _time hostname os arch version sourceIp destPort fwdType ssl

In above query if you change INDEXER_SERVERNAME with HeavyForwarder_SERVERNAME you will able to figure out if any universal forwarders are sending data to Heavy Forwarder or not.

I didn't get your question Data is getting managed by Deployment server?, Deployment server will deploy configuration to UF, Heavy Forwarders etc. but it will not manage any data.

0 Karma

Sharmarohit1234
New Member

Thanks for your answer, I was not sure yesterday whether deployment server can manage the data as well or just apps, did some more research and found my answer.

Thanks for your support.
Regards
Rohit

0 Karma

iamarkaprabha
Contributor

You need to open up that port for sending data into your Deployment server.
If you have any FW on your env, you need to probably open that up too

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...