https://community.splunk.com/t5/Splunk-Cloud-Platform/Forwarding-ID/m-p/574054#M1171 <P>Is there a way to find which forwarder a devices event logs came from.<BR />I have hundreds of devices sending WEC logs through WEC servers, I could really do with an easy method to pinpoint where they came from during search time.</P><P>Something like<BR />Index=wec_index<BR />| ctable hosts,&nbsp; WECSvr</P> Mon, 08 Nov 2021 17:30:34 GMT DaveBunn 2021-11-08T17:30:34Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Forwarding-ID/m-p/574054#M1171 <P>Is there a way to find which forwarder a devices event logs came from.<BR />I have hundreds of devices sending WEC logs through WEC servers, I could really do with an easy method to pinpoint where they came from during search time.</P><P>Something like<BR />Index=wec_index<BR />| ctable hosts,&nbsp; WECSvr</P> Mon, 08 Nov 2021 17:30:34 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Forwarding-ID/m-p/574054#M1171 DaveBunn 2021-11-08T17:30:34Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Forwarding-ID/m-p/574103#M1172 <P>Hello,</P><P>You could use the below search and also you can track it in cloud monitoring console.</P><LI-CODE lang="markup">index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) by hostname</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Thanks&nbsp;</P> Tue, 09 Nov 2021 00:24:52 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Forwarding-ID/m-p/574103#M1172 Roy_9 2021-11-09T00:24:52Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Forwarding-ID/m-p/581214#M1245 <P>Thanks Roy99 - worked perfectly - easy when you know how.</P> Sat, 15 Jan 2022 17:29:58 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Forwarding-ID/m-p/581214#M1245 DaveBunn 2022-01-15T17:29:58Z