Splunk Search

Finding the HeavyForwarder hosts from _internal logs

santosh_hb
Explorer

Hi,

I have a task where I have to find all of the Heavy Forwarders that are currenly connected and sending the log data to the Splunk Indexer. I have to find all of the Heavy Forwarders hostname through the internal logs only. Could you help me with the query?

regards,
Santosh

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @santosh_hb,

You can use below query to find out all Enterprise Instances which are sending logs to Indexers. After that you need to filter out which one is Search Head, Cluster Master, Deployer, Deployement Server etc.

index=_internal host=<INDEXER> source=*metrics.log* group=tcpin_connections fwdType=full | dedup hostname | table _time hostname os arch version sourceIp destPort fwdType ssl

View solution in original post

0 Karma

burwell
SplunkTrust
SplunkTrust

We also wanted to track our heavy forwarder use and our Splunk PE advised us to use meta data.

There are two things to do.

1) On each heavy forwarder in an inputs.conf, e.g. /opt/splunk/etc/system/local/inputs.conf

[default]
host = yourhost.yourcompany.com
_meta = splunk_heavyforwarder::yourhost.yourcompany.com

Substitute yourhost.yourcompany.com with your hostname. Unfortunately each heavy forwarder will have to have its exact host name.

2) On your search heads or search head cluster in fields.conf

[splunk_heavyforwarder]
INDEXED = true

And then you can search for, or do stats with splunk_heavyforwarder (like splunk_server).

0 Karma

bambarit
Explorer

Hi, can we extract by props  transforms to track HF?

0 Karma

harsmarvania57
Ultra Champion

Hi @santosh_hb,

You can use below query to find out all Enterprise Instances which are sending logs to Indexers. After that you need to filter out which one is Search Head, Cluster Master, Deployer, Deployement Server etc.

index=_internal host=<INDEXER> source=*metrics.log* group=tcpin_connections fwdType=full | dedup hostname | table _time hostname os arch version sourceIp destPort fwdType ssl
0 Karma

whrg
Motivator

Hello!

Recently, I have built a dashboard to have a quick overview over all my Splunk instances. I found it difficult to filter for Heavy Forwarders because Heavy Forwarders are actually full Splunk instances like Search Heads or Deployment Servers.

Perhaps these searches will help you. Set the time range accordingly to show all active servers in that particular time range.

Here is the search for all full Splunk instances (Search Head, Heavy Forwarders...):

index=_internal sourcetype=splunkd source=*metrics.log group=tcpin_connections fwdType="full" | dedup hostname | table hostname,os,version | sort hostname

Here is the search for all Universal Forwarders:

index=_internal sourcetype=splunkd source=*metrics.log group=tcpin_connections fwdType="uf" | dedup hostname | table hostname,os,version | sort hostname

Here is the search for all Indexers:

| rest /services/server/info | search server_roles="indexer" | table splunk_server,os_name,version | sort splunk_server
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...