https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292198#M88276 <P>Hello,</P> <P>Can i please know how to get the all forwarders IP addresses that a reporting to splunk without use of internal index as some of the users don't have access to the internal data . Therefore, searches created with index=_internal will not work for those people. Is there anyway to create the search without of the use of that to get the all forwarders IP's ?</P> Tue, 09 Jan 2018 19:35:46 GMT kteng2024 2018-01-09T19:35:46Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292198#M88276 <P>Hello,</P> <P>Can i please know how to get the all forwarders IP addresses that a reporting to splunk without use of internal index as some of the users don't have access to the internal data . Therefore, searches created with index=_internal will not work for those people. Is there anyway to create the search without of the use of that to get the all forwarders IP's ?</P> Tue, 09 Jan 2018 19:35:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292198#M88276 kteng2024 2018-01-09T19:35:46Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292199#M88277 <P>I use this as a saved search and have it Run As "owner".</P> <PRE><CODE>index=_internal source=*metrics.log* group=tcpin_connections | regex hostname!="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" | eval sos_server=hostname | stats latest(sourceIp) AS IP latest(arch) AS cpu_arch latest(fwdType) AS forwarder_type latest(os) AS os_name latest(version) AS version by sos_server </CODE></PRE> Tue, 09 Jan 2018 19:39:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292199#M88277 JDukeSplunk 2018-01-09T19:39:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292200#M88278 <P>Hi kteng2024,<BR /> you could create a scheduled search and put results in a lookup using outputlookup command.<BR /> In this way users with no access to _internal can have the result.<BR /> Bye.<BR /> Giuseppe</P> Tue, 09 Jan 2018 19:41:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292200#M88278 gcusello 2018-01-09T19:41:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292201#M88279 <P>You can create a dashboard that makes use of a savedsearch configured to run as the owner of the savedsearch, even if the users accessing the dashboard don't have permission to search _internal.</P> <P><A href="https://answers.splunk.com/answers/550511/how-to-restrict-user-access-to-search-from-dashboa.html">This recent answers post</A> explains the concept.</P> Tue, 09 Jan 2018 19:42:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292201#M88279 micahkemp 2018-01-09T19:42:01Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292202#M88280 <P>hey @kteng2024</P> <P>Try this</P> <PRE><CODE> | rest /services/deployment/server/clients | table dns ip | rename ip as forwarder_ip </CODE></PRE> <P>let me know if this helps!</P> Tue, 09 Jan 2018 19:50:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292202#M88280 mayurr98 2018-01-09T19:50:04Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292203#M88281 <P>Best way would be to have a saved search, owned by your/splunk admin, which queries that data from _internal index and puts it to, 1) a lookup table, if number of clients is smaller (&lt;10k), 2) summary index, for larger number of clients, make sure regular user have access to this summary index. </P> Tue, 09 Jan 2018 20:30:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292203#M88281 somesoni2 2018-01-09T20:30:35Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292204#M88282 <P>This would be a great method for admins to know the requested information. This REST endpoint is only available from Deployment server (unless Deployment server is added as search peer to search head). Furthermore, capability of running REST queries may not be available to regular users (depends upon authorization settings), making is less feasible.</P> Tue, 09 Jan 2018 20:33:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/292204#M88282 somesoni2 2018-01-09T20:33:07Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/578675#M201678 <P>Thank you, that was I want to use to recognize some UF that we use to forward data to our ES environment and aren't under my administration.</P> Thu, 16 Dec 2021 20:17:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-forwarder-IP-address-reproting-to-splunk/m-p/578675#M201678 lenrigodoy 2021-12-16T20:17:58Z