topic Who is forwarding data in Getting Data In

Who is forwarding data

bc_unixadm — Tue, 27 Apr 2010 20:26:56 GMT

How can I tell which servers in my enterprise are forwarding to the master server. We do automated installs of vm's and splunk is automated to install and start but I would like to have a picture or list from within the app to show that I am receiving data from the servers after installation.

Thanks Mark

Re: Who is forwarding data

muebel — Tue, 27 Apr 2010 20:30:13 GMT

one way is to run the following search to give an idea of which hosts are fowarding how many events

* | chart count(host) by host

Run this over the last 15 minutes.

Re: Who is forwarding data

kbecker — Tue, 27 Apr 2010 20:32:59 GMT

This will give you a list of the hosts that Splunk knows about... | metadata type=hosts | fields host

Re: Who is forwarding data

bc_unixadm — Tue, 27 Apr 2010 21:32:22 GMT

Solution is what I was looking for.

Re: Who is forwarding data

bc_unixadm — Tue, 27 Apr 2010 21:32:43 GMT

Both solutions work.. Thanks to both.

Re: Who is forwarding data

bc_unixadm — Tue, 27 Apr 2010 21:33:53 GMT

Both solutions work, thanks very much has made my manual process automated.