topic Re: hosts reporting stats in Monitoring Splunk

hosts reporting stats

FAnalyst — Thu, 27 Feb 2025 12:51:14 GMT

I see there is a forwarder management dashboard in the monitoring console where you can check if the host is reporting or not , I want the search that is used as the table contains the host name and the IP address , also there is no option for export in that dashboard , there is another similar dashboard in the monitoring console named forwarder_deployment but does not show the IP address only the host name , can you help with that ?

Re: hosts reporting stats

Cievo — Thu, 27 Feb 2025 12:53:39 GMT

You can serch using following searches:

| tstats values(splunk_server) as Host, values(clientip) as IP
from _internal
where index=_internal sourcetype=splunkd
by host

index=_internal sourcetype=splunkd
| stats values(clientip) as IP by host

Enjoy,

Re: hosts reporting stats

FAnalyst — Thu, 27 Feb 2025 12:59:29 GMT

thank you for your answer ,I tried the search you shared is does not show the IP address of the hosts , also the number does not match the number showing in the forwarder management dashboard

Re: hosts reporting stats

kiran_panchavat — Thu, 27 Feb 2025 13:01:17 GMT

@FAnalyst

Use the below search to get an exportable list of deployment clients.

| rest splunk_server=local /services/deployment/server/clients 
| table hostname utsname 
| sort utsname

Another way to find forwarders is to search the internal index for incoming TCP connections.

index=_internal sourcetype=splunkd component=Metrics group=tcpin_connections 
| dedup sourceHost 
| table sourceHost fwdType

To see all hosts that send data, not just forwarders, count the hosts found in all indexes.

| tstats count where index=* host=* by host

Re: hosts reporting stats

kiran_panchavat — Thu, 27 Feb 2025 13:02:21 GMT

@FAnalyst

You should be able to get list of whitelist servers using following query.

| rest /services/deployment/server/serverclasses | table title whitelist.* | untable title whitelist hostname | stats count by hostname | table hostname

You can put it to in a lookup file or just use the rest query itself and compare it against deployment/server/clients to know which clients that are configured in serverclass.conf but not sending phonehome. Something like this

| rest /services/deployment/server/serverclasses | table title whitelist.* | untable title whitelist hostname | stats count by hostname | table hostname | eval state="configured" | append [| rest /services/deployment/server/clients | table title | rename title as hostname | eval state="phonehome" ] | stats values(state) as state by hostname | where mvcount(state)=1 AND state="configured"

Re: hosts reporting stats

kiran_panchavat — Thu, 27 Feb 2025 13:04:06 GMT

@FAnalyst

Try this

index=_internal sourcetype=splunkd component=Metrics group=tcpin_connections 
| dedup sourceHost 
| table sourceHost fwdType

Re: hosts reporting stats

livehybrid — Thu, 27 Feb 2025 14:05:30 GMT

Hi @FAnalyst

The answers provided so far look to either look at forwarders sending data to your Splunk indexers, or look at allowlist configurations in serverclasses, however I believe you are looking for the host and IP of deployment clients when they connect? If that is the case then try the below search:

| tstats latest(_time) as lastPhoneHome WHERE index=_dsphonehome earliest=-24h latest=now by data.clientId | append [| tstats latest(_time) as lastRestart where index=_dsclient earliest=0 latest=now by data.name, data.build, data.clientId, data.splunkVersion data.package, data.hostname] | stats latest(*) AS * by data.clientId | eval lastPhoneHomeFriendly=strftime(lastPhoneHome,"%d/%m/%Y %H:%M:%S")

This was tested on SPlunk 9.3 but I believe should work from <9.2

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will