https://community.splunk.com/t5/Splunk-Enterprise/Heavy-forwarder-view-Universal-forwarders/m-p/540468#M4988 <P>HI I have a web UI connection into the Heavy Forwarder over port 8000.</P><P>Is there a way I can view a list of universal forwarders that are sending to this Heavy forwarder?</P> Fri, 19 Feb 2021 04:45:13 GMT iherb_0718 2021-02-19T04:45:13Z https://community.splunk.com/t5/Splunk-Enterprise/Heavy-forwarder-view-Universal-forwarders/m-p/540468#M4988 <P>HI I have a web UI connection into the Heavy Forwarder over port 8000.</P><P>Is there a way I can view a list of universal forwarders that are sending to this Heavy forwarder?</P> Fri, 19 Feb 2021 04:45:13 GMT https://community.splunk.com/t5/Splunk-Enterprise/Heavy-forwarder-view-Universal-forwarders/m-p/540468#M4988 iherb_0718 2021-02-19T04:45:13Z https://community.splunk.com/t5/Splunk-Enterprise/Heavy-forwarder-view-Universal-forwarders/m-p/540472#M4990 <P>This will give list of universal fwds sending data:</P><LI-CODE lang="markup">index=_internal source=*metrics.log group=tcpin_connections fwdType="uf" earliest=-1h | eval sourceHost=coalesce(hostname, sourceHost) | fields _time connectionType sourceIp sourceHost destPort splunk_server version hostname | stats latest(_time) as _time latest(*) as * by sourceHost</LI-CODE><P>&nbsp;</P><P>If this reply helps you, an upvote/like would be appreciated.</P> Fri, 19 Feb 2021 05:57:42 GMT https://community.splunk.com/t5/Splunk-Enterprise/Heavy-forwarder-view-Universal-forwarders/m-p/540472#M4990 manjunathmeti 2021-02-19T05:57:42Z