topic Re: list host, source by forwarder in Getting Data In

list host, source by forwarder

dominiquevocat — Thu, 04 Sep 2014 08:11:11 GMT

How do i get a list comprising the fields host, source for each forwarder.

Background: the admins of the machines where the forwarder runs on seem to have made mistakes when adding a monitor and i would like to identify which ones are wrong and provide a clearing list.
The field that is wrong is unfortunately "host". By identifying which "host,source" by forwarder i can tell which forwarder needs to be corrected.

Re: list host, source by forwarder

strive — Thu, 04 Sep 2014 09:51:45 GMT

Try this

|metasearch host=* | dedup source | table host, source

Re: list host, source by forwarder

dominiquevocat — Thu, 04 Sep 2014 10:50:51 GMT

I updated the question, sorry. The field that is wrong is "host"...

Re: list host, source by forwarder

strive — Thu, 04 Sep 2014 11:19:07 GMT

The above search should work for your needs. In case if you need splunk server details also then do this

|metasearch host=* | dedup source | table host, source, splunk_server

Re: list host, source by forwarder

strive — Thu, 04 Sep 2014 11:20:39 GMT

Are you configuring what should be host in inputs.conf? If not the host name set on the device will be taken automatically.

Re: list host, source by forwarder

dominiquevocat — Thu, 04 Sep 2014 11:32:46 GMT

i have reason to suspect, that the guy indexing files specified the host when doing "add monitor" on the command line.

Re: list host, source by forwarder

strive — Thu, 04 Sep 2014 11:42:42 GMT

Ok. In any case, the above search in my comment should work. are you seeing any issues with the search?

Re: list host, source by forwarder

MuS — Thu, 04 Sep 2014 12:40:26 GMT

Hi dominiquevocat,

because it is fun to play around in Splunk and always look for other ways to get the results, try this:

 index=_internal ( source=*license_usage.log type!=*Summary ) OR ( source=*metrics.log group=tcpin_connections fwdType=uf ) | streamstats last(sourceIp) AS last_ip last(hostname) AS last_hostname | where h=last_hostname | stats values(last_ip) AS IP values(st) AS sourcetype values(s) AS source by h | rename h AS Host

This will give you a nice table view of each Hosts Name, IP used, sourcetype used and sources used.

hope this helps ...

cheers, MuS

Re: list host, source by forwarder

dominiquevocat — Thu, 04 Sep 2014 14:06:04 GMT

looks nice! perhaps due to the large amount of files on one of the hosts it stops after some 30'000 or so sources...

Re: list host, source by forwarder

MuS — Thu, 04 Sep 2014 14:07:52 GMT

HeHe, try to limit the base search by using snippets of the source name or ip or hostname 😉

Re: list host, source by forwarder

dominiquevocat — Mon, 08 Sep 2014 11:56:22 GMT

nope, because the value in "host" is the wrong one (overridden value) and i need to ip or hostname of the forwarder where this came from.