topic Re: search to show me all my splunk enterprise devices in Splunk Search

search to show me all my splunk enterprise devices

net1993 — Wed, 29 Jan 2020 07:42:07 GMT

Hi
Is there a search in splunk which I can run from search head which will show me all splunk enterprise devices?

Re: search to show me all my splunk enterprise devices

gcusello — Wed, 29 Jan 2020 07:57:56 GMT

Hi @net1993,
what do you mean with "splunk enterprise devices"?
if you mean Splunk Enterprise components (Search Heads, Indexers, Heavy Forwarders Universal Forwarders, and the other roles, you can configure and use Monitor Console [Settings -- Monitor Console].

You can also have an idea with a simple search index=_internal | stats count BY host because in this way you have the internal logs of all Splunk components, but you cannot separate Universal Forwarders from the others.

Ciao.
Giuseppe

Re: search to show me all my splunk enterprise devices

MuS — Wed, 29 Jan 2020 08:01:13 GMT

Hi net1993,

if all of your Splunk Enterprise instances are configured using best practices then they forward their _internal logs to your indexer. This means you can search the index=_internal for these instances like this:

index=_internal sourcetype=splunkd fwdType=full

Hope this helps ...

cheers, MuS

Re: search to show me all my splunk enterprise devices

skalliger — Wed, 29 Jan 2020 08:13:44 GMT

If you're referring to Splunk Enterprise instances as well as Forwarders, you might want to take a look into the Monitoring Console as it offers all of that. If you want those dashbaords combined, just steal that SPL and put it in your own dashboard as many of those searches are simply searching through the _internal index of Splunk.

Skalli

Re: search to show me all my splunk enterprise devices

skalliger — Wed, 29 Jan 2020 08:14:01 GMT

Oh, I was too slow 😞