https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164255#M46655 <P>I used your solution to solve my question here.. Thanks for posting this! </P> <P><A href="https://answers.splunk.com/answers/379013/alert-if-a-forwarder-service-stops.html">https://answers.splunk.com/answers/379013/alert-if-a-forwarder-service-stops.html</A></P> Thu, 17 Mar 2016 13:45:21 GMT skoelpin 2016-03-17T13:45:21Z https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164250#M46650 <P>Greetings</P> <P>Is there a query that I can use on my search head to list all my forwarder hosts and their associated splunk forwarder versions</P> Wed, 15 Oct 2014 19:06:34 GMT https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164250#M46650 locose 2014-10-15T19:06:34Z https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164251#M46651 <P>This is part of what the SoS app uses to update its forwarders lookup file:</P> <PRE><CODE> index=_internal source=*metrics.log* group=tcpin_connections | regex hostname!="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" | eval sos_server=hostname | stats latest(build) AS build latest(arch) AS cpu_arch latest(fwdType) AS forwarder_type latest(os) AS os_name latest(version) AS version by sos_server </CODE></PRE> <P><A href="https://apps.splunk.com/app/748/">https://apps.splunk.com/app/748/</A></P> Wed, 15 Oct 2014 19:14:13 GMT https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164251#M46651 martin_mueller 2014-10-15T19:14:13Z https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164252#M46652 <P>Many thanks. That worked</P> Wed, 15 Oct 2014 19:24:24 GMT https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164252#M46652 locose 2014-10-15T19:24:24Z https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164253#M46653 <P>If you can't do SoS, then here's a simple search against the _internal index that works for me;</P> <P>index=_internal sourcetype=splunkd version source=*metrics.log | table hostname os version build</P> Wed, 15 Oct 2014 19:48:33 GMT https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164253#M46653 jeremiahc4 2014-10-15T19:48:33Z https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164254#M46654 <P>I think this is what you are looking for:</P> <P>index=_internal sourcetype=splunkd destPort!="-"| stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - count</P> Fri, 22 Jan 2016 20:37:41 GMT https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164254#M46654 rameshyedurla 2016-01-22T20:37:41Z https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164255#M46655 <P>I used your solution to solve my question here.. Thanks for posting this! </P> <P><A href="https://answers.splunk.com/answers/379013/alert-if-a-forwarder-service-stops.html">https://answers.splunk.com/answers/379013/alert-if-a-forwarder-service-stops.html</A></P> Thu, 17 Mar 2016 13:45:21 GMT https://community.splunk.com/t5/Splunk-Search/What-search-query-can-I-use-on-my-search-head-to-list-all/m-p/164255#M46655 skoelpin 2016-03-17T13:45:21Z