https://community.splunk.com/t5/Getting-Data-In/Need-help-with-splunk-SPL-or-REST-API/m-p/623408#M107269 <P>Need help with splunk SPL or rest api to fetch areport where we can see the count of total servers(splunk universal forwarders) reporting to IDX and HF with breakup.</P><P>Some UF are sending data to IDXers directly and few of them are sending it via HF(due to some connection issues we have followed this architecture)<BR /><BR />Please assist me on the same.</P> Tue, 06 Dec 2022 11:12:31 GMT AK_Splunk 2022-12-06T11:12:31Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-splunk-SPL-or-REST-API/m-p/623408#M107269 <P>Need help with splunk SPL or rest api to fetch areport where we can see the count of total servers(splunk universal forwarders) reporting to IDX and HF with breakup.</P><P>Some UF are sending data to IDXers directly and few of them are sending it via HF(due to some connection issues we have followed this architecture)<BR /><BR />Please assist me on the same.</P> Tue, 06 Dec 2022 11:12:31 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-splunk-SPL-or-REST-API/m-p/623408#M107269 AK_Splunk 2022-12-06T11:12:31Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-splunk-SPL-or-REST-API/m-p/623434#M107274 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/243360">@AK_Splunk</a>&nbsp;<BR /><BR />can you run&nbsp; <STRONG>query1</STRONG> or <STRONG>query2</STRONG> search in search head , hope one of helps your requriment&nbsp;</P><P><STRONG>Query1</STRONG></P><P>index=_internal source="*metrics.log" group="tcpin_connections"<BR />| dedup hostname<BR />| rename host as "receiver host" hostname as "sender host"<BR />| table _time "sender host" connectionType version sourceIp destPort&nbsp;ssl fwdType "receiver host"&nbsp;<BR /><BR /><STRONG><BR /></STRONG></P><P><STRONG>Query2<BR /><BR /></STRONG>index=_internal source="*metrics.log"&nbsp;host IN (UF1,UF2)&nbsp;<BR />group=tcpout_connections<BR />| stats count by host destIp destPort<STRONG><BR /></STRONG></P> Tue, 06 Dec 2022 14:48:59 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-splunk-SPL-or-REST-API/m-p/623434#M107274 SanjayReddy 2022-12-06T14:48:59Z