https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-OS-version/m-p/377639#M68322 <P>Hi,</P> <P>i am able to get spunk forwarder deaials using below query but i need information like windows 2012,2016, linux version 2,3 ,4 etc. <BR /> How can we get this OS info.</P> <P>index=_internal source=*metrics.log component=Metrics group=tcpin_connections <BR /> | dedup hostname | table hostname sourceIp os arch version</P> <P>Regards</P> Wed, 30 Sep 2020 00:35:40 GMT keishamtcs 2020-09-30T00:35:40Z https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-OS-version/m-p/377639#M68322 <P>Hi,</P> <P>i am able to get spunk forwarder deaials using below query but i need information like windows 2012,2016, linux version 2,3 ,4 etc. <BR /> How can we get this OS info.</P> <P>index=_internal source=*metrics.log component=Metrics group=tcpin_connections <BR /> | dedup hostname | table hostname sourceIp os arch version</P> <P>Regards</P> Wed, 30 Sep 2020 00:35:40 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-OS-version/m-p/377639#M68322 keishamtcs 2020-09-30T00:35:40Z https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-OS-version/m-p/377640#M68323 <P>Here is a search that I often use to check on how much data is being sent per hour, by forwarder.</P> <PRE><CODE> index=_internal source=*metrics.log group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | rename connectionType as connectType | eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder") | eval version=if(isnull(version),"pre 4.2",version) | rename version as Ver | fields connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver | eval Indexer= splunk_server | eval Hour=relative_time(_time,"@h") | stats avg(tcp_KBps) sum(tcp_eps) sum(tcp_Kprocessed) sum(kb) by Hour connectType sourceIp sourceHost destPort Indexer Ver | fieldformat Hour=strftime(Hour,"%x %H") </CODE></PRE> <P>Just copy this search and paste into your search box - and pick a relatively short time period (like last 24 hours or less). It should run on any Splunk 4.2 or newer. It might work on older versions, but I am not sure...</P> <P>You could change the stats command if you wanted a slightly different output. For example, replace the last 3 lines with the following to get an overall summary by forwarder, rather than hour by hour statistics:</P> <PRE><CODE> | stats avg(tcp_KBps) sum(tcp_eps) sum(tcp_Kprocessed) sum(kb) by connectType sourceIp sourceHost destPort Indexer Ver </CODE></PRE> Fri, 17 May 2019 17:58:45 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-OS-version/m-p/377640#M68323 vikramyadav 2019-05-17T17:58:45Z https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-OS-version/m-p/377641#M68324 <P>Hi,</P> <P>Your search does not give the information i am looking for that is OS details like windows 2012,2016, linux version 2,3 ,4 etc.</P> <P>Regards</P> Mon, 20 May 2019 08:24:05 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-OS-version/m-p/377641#M68324 keishamtcs 2019-05-20T08:24:05Z