topic Re: Splunk FOrwarder information in the API in Getting Data In

Splunk FOrwarder information in the API

akrai — Thu, 11 Jul 2019 00:03:25 GMT

I need to know if my asset/ hosts/devices has splunk forwarder installed . Which API would give me that information, and what would be the column name in that API.

Re: Splunk FOrwarder information in the API

nabeel652 — Thu, 11 Jul 2019 00:43:55 GMT

Not sure about an API but you could do a powershell script like this:

    $computers = "Computer1", "Computer2", "Computer3", "Computer4"


foreach ($computer in $computers){ 
    try {
        $result = Get-Service -ComputerName $computer | where {$_.Name -like "SplunkForwarder"}
    }
    catch {
        Write-Host "Some problem occured accessing" $computer -ForegroundColor Red
    }
    if ($result -ne $null) {
        Write-Host $computer "Has Splunk Forwarder Installed" -ForegroundColor Green
    }
    $result = $null
}

Re: Splunk FOrwarder information in the API

akrai — Thu, 11 Jul 2019 00:59:11 GMT

Thanks for the response,, Appreciate it.. I am specifically looking for the API which can bring in the splunk forwarder information.
My usecase would be enterprise wide and would not be feasible to get a report for all the splunk forwarder information.