https://community.splunk.com/t5/Deployment-Architecture/Heavy-Forwarders-Query/m-p/533371#M18352 <P>If your logs go back far enough to capture when the HFs started then this may get you started.</P><LI-CODE lang="markup">index=_internal component=ServerRoles "Declared role" | stats values(role) as roles by host</LI-CODE> Wed, 16 Dec 2020 21:12:40 GMT richgalloway 2020-12-16T21:12:40Z https://community.splunk.com/t5/Deployment-Architecture/Heavy-Forwarders-Query/m-p/533358#M18350 <P>I have found different articles that query and return information about universal forwarders. But I am trying to get a list of heavy forwarders that the splunk system has. Does anyone have a simple script that would give me a list of all heavy forwarders.&nbsp;</P> Wed, 16 Dec 2020 19:36:47 GMT https://community.splunk.com/t5/Deployment-Architecture/Heavy-Forwarders-Query/m-p/533358#M18350 carlosvalcarcel 2020-12-16T19:36:47Z https://community.splunk.com/t5/Deployment-Architecture/Heavy-Forwarders-Query/m-p/533371#M18352 <P>If your logs go back far enough to capture when the HFs started then this may get you started.</P><LI-CODE lang="markup">index=_internal component=ServerRoles "Declared role" | stats values(role) as roles by host</LI-CODE> Wed, 16 Dec 2020 21:12:40 GMT https://community.splunk.com/t5/Deployment-Architecture/Heavy-Forwarders-Query/m-p/533371#M18352 richgalloway 2020-12-16T21:12:40Z https://community.splunk.com/t5/Deployment-Architecture/Heavy-Forwarders-Query/m-p/533399#M18353 <P>unfortunately my logs don't go back long enough. I try the query but since my logs don't go back that far it does not provide me with information.&nbsp;</P> Thu, 17 Dec 2020 04:47:40 GMT https://community.splunk.com/t5/Deployment-Architecture/Heavy-Forwarders-Query/m-p/533399#M18353 carlosvalcarcel 2020-12-17T04:47:40Z