topic Re: Splunk Universal Forwarder Phone Home Via Intermediate Forwarder in Splunk Enterprise

Splunk Universal Forwarder Phone Home Via Intermediate Forwarder

JselbyELC — Fri, 25 Jan 2019 14:32:43 GMT

Hi All,

I'm currently using a query on a dashboard that is showing Splunk Machines that are online,
index="_internal" services/broker/phonehome/connection | stats count by host (for the past 15 minutes)

My problem is half of my machines sit behind a firewall and send their data via an intermediate forwarder.

Diagram Bellow (Security Team wouldn't sign off the solution unless i followed this approach)

I cannot show the status of these endpoints using the same method as the host value for data in the internal index has the forwarder's hostname rather than the actual endpoint.

Has anyone found a way around this?

Thanks

Josh

Re: Splunk Universal Forwarder Phone Home Via Intermediate Forwarder

nickhills — Fri, 25 Jan 2019 16:29:24 GMT

Try this:

index="_internal" services/broker/phonehome/connection 
| rex field=uri "8089_(?P<client>.+?)_" | stats count by client

It will give you a DNS name when it has one, or failing that an IP if it cant be resolved.

Re: Splunk Universal Forwarder Phone Home Via Intermediate Forwarder

woodcock — Fri, 25 Jan 2019 22:13:10 GMT

You should not "make it work" the way that it is. You should correct your forwarding so that the intermediate forwarder is NOT listead as host. This is not difficult and there are many articles and approaches on how to do host override.

Re: Splunk Universal Forwarder Phone Home Via Intermediate Forwarder

JselbyELC — Tue, 05 Feb 2019 19:01:53 GMT

Thank you for your help the query was very helpful, i managed to fix my Hostname problem after restarting the splunk server a couple of times!