topic Re: Help locating what forwarder data is coming from in Getting Data In

Help locating what forwarder data is coming from

jbleich — Mon, 04 Aug 2014 20:58:53 GMT

I'm a new splunk user, so be kind 🙂

I have about 80% of my daily volume coming in what i believe to be un-needed informaton. I cant tell where the data is coming from, all i know is index=main and sourcetype=Perfmon:process

Now i thought it was the universal forwarders on my DC's, I have 2 of them and pushed out the app via the deployment server and i changed the .conf file to disable Perfmon:process, but apparently that wasnt it...it must be coming from somewhere else.

Any help would be appreciated.

Re: Help locating what forwarder data is coming from

somesoni2 — Mon, 04 Aug 2014 21:02:06 GMT

There should be a field host which should tell you from which server its coming from.

Re: Help locating what forwarder data is coming from

strive — Tue, 05 Aug 2014 02:06:31 GMT

somesoni2 has already pointed what you need to check.

index=main | dedup host | table host

Re: Help locating what forwarder data is coming from

linu1988 — Tue, 05 Aug 2014 04:20:09 GMT

Hello,
below is the fastest way to get the time and host which is responsible for the data.

|metadata type=hosts index=*

It shows you the first and latest received event time and number of events. So try this.

Thanks,
L

Re: Help locating what forwarder data is coming from

jbleich — Tue, 05 Aug 2014 13:57:51 GMT

I know what server it's coming from I'm trying to find out if it's some default data from the universal forwarder, from the windows infrastructure app, or from the VMware app we have loaded.

I dont think it's the vmware app because it splits their sourcetypes into vmware:something...

So I think it's either the default or the infrastrcture app.

I have suspicions it's the default forwarder actions, but if that's the case why wouldnt every server i have the forwarder on send perfmon data, unless it's because these 2 are my DCs.

In any event Im more interested in blocking it.