topic Re: path or logfiles location for 1500 servers in Getting Data In

path or logfiles location for 1500 servers

Mukunda7 — Mon, 04 Oct 2021 08:29:11 GMT

Hey,

We have some 1500 servers where splunk forwarders installed. we need the path to find location of data or logs coming from these servers. Is there a simple way to do that?

Re: path or logfiles location for 1500 servers

gcusello — Mon, 04 Oct 2021 08:39:50 GMT

Hi @Mukunda7,

you should know where Universal Forwarder is installed on your servers, anyway, you could try a search like this:

index=_internal | rex field=source "^(?<inst_path>.*splunkforwarder|splunkuniversalforwarder)" | stats values(inst_path) AS inst_path BY host

Ciao.

Giuseppe

Re: path or logfiles location for 1500 servers

Mukunda7 — Mon, 04 Oct 2021 09:00:40 GMT

@gcusello

thanks but the path we are getting here is of forwarders path or path of logs,file types we configured to send to splunk ? please elaborate

Re: path or logfiles location for 1500 servers

gcusello — Mon, 04 Oct 2021 09:12:25 GMT

Hi @Mukunda7,

if you want the path of the forwarders, you can use my search.

if you want the path and the filename of all log files, you can use a similar search:

| metasearch index=* | stats count BY source

if instead you want only the path but not the filename of all log files, you can use a similar search:

for Windows servers:

| metasearch index=* | rex field=source "(?<log_path>.*)\\\.+$" | stats count BY log_path

for Linux servers:

| metasearch index=* | rex field=source "(?<log_path>.*)\/.+$" | stats count BY log_path

probably it will works also one search with both the regexes, but I cannt try it:

| metasearch index=* | rex field=source "(?<log_path>.*)((\\\)|(\/)).+$" | stats count BY log_path

Ciao.

Giuseppe

Re: path or logfiles location for 1500 servers

Mukunda7 — Mon, 04 Oct 2021 10:04:36 GMT

@gcusello

Fantastic thanks. what can we add in the query to display names of respective servers and path and the filename of all log files.

Re: path or logfiles location for 1500 servers

gcusello — Mon, 04 Oct 2021 10:20:47 GMT

Hi @Mukunda7,

good for you, see next time!

if this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

Re: path or logfiles location for 1500 servers

gcusello — Mon, 04 Oct 2021 11:21:36 GMT

Hi @Mukunda7,

actually, i wanted to answer you in this fid way right away, but i forgot to edit the answer,

to have only the path,

you could use this search for windows servers:

| metasearch index=* | rex field=source "(?<log_path>.*)\\\.+$" | stats values(log_path) AS log_path count BY host

and for Linux servers:

| metasearch index=* | rex field=source "(?<log_path>.*)\/.+$" | stats values(log_path) AS log_path count BY host

if you want all the source files, you could use this search both for Windows and Linux:

| metasearch index=* | stats values(source) AS source count BY host

Ciao.

Giuseppe