topic Re: Find where a forwarder is forwarding too in Splunk Search

Find where a forwarder is forwarding too

AaronMoorcroft — Wed, 09 Oct 2013 10:47:07 GMT

Hey Guys

I have multiple DMZs with forwarders all over the places that send to specific main forwarders if you like and then onto the indexer, is there a search that anyone knows of that I can run on a host to tell me where that device is set to forward too, I have a few boxs I need to jump on but its would be better if I can run a search as to jumping through hoops to log onto the actual device its self.

Thanks

Aaron

Re: Find where a forwarder is forwarding too

MuS — Wed, 09 Oct 2013 11:05:55 GMT

Hi AaronMoorcroft

assuming your forwarders are forwarding their _internal index, you can use the following search to find the tcpout connection targets for all forwarders:

index=_internal source=*metrics.log* group=tcpout_connections | chart values(destIp) by host

hope this helps...

cheers, MuS

Re: Find where a forwarder is forwarding too

sowings — Wed, 09 Oct 2013 13:10:16 GMT

This approach might work even if only the intermediate forwarders are sending their _internal index events; you'd see incoming connections from the various forwarders in the metrics.log.

Re: Find where a forwarder is forwarding too

AaronMoorcroft — Thu, 10 Oct 2013 08:47:29 GMT

That does seem to bring a few up with the expected results but by no means all, do you have any further advice ?

Re: Find where a forwarder is forwarding too

MuS — Thu, 10 Oct 2013 09:02:13 GMT

as I said, you need to have the forwarders _internal available. Another way would be to use the REST endpoint /data/outputs/tcp/ but again, this must be done against each forwarder. I would suggest to enable _internal forwarding this would also help in any case of troubleshooting future issues.