topic List of universal Forwarder in Security

List of universal Forwarder

rahul2gupta — Fri, 17 Sep 2021 04:58:04 GMT

Hi,

Is there any method to get the list of all the universal forwarder that is being forwarded to Indexer?

Regards,

Rahul

Re: List of universal Forwarder

gcusello — Fri, 17 Sep 2021 06:56:33 GMT

Hi @rahul2gupta,

you can run a simple search like this:

index=_internal | stats count BY host

Buy it's easier to see in the Monitoring Console at [Settings -- Monitoring Console -- Forwarders -- Forwarders: Deployment].

Ciao.

Giuseppe

Re: List of universal Forwarder

PickleRick — Fri, 17 Sep 2021 07:21:26 GMT

Also - I can imagine a situation (it would be very uncommon though but it's possible) that someone disables monitoring local forwarder log files and forwarding them to indexers. That way you'd be left without entries in _internal index regarding this particular forwarder.

But yes, that's very unprobable.

Re: List of universal Forwarder

gcusello — Fri, 17 Sep 2021 07:26:18 GMT

Hi at all,

using the _internal logs you're sure that the forwarder is working and this is the first step in monitoring.

Then if someone modified the local configurations is a different thing, if you use a Deployment Server it continuously checks the local configurations and updates them if wrong.

Ciao.

Giuseppe