Where can I find the searches that power the Forwarder Management console?



Where can I find the searches that power the Forwarder Management console? I am looking to export and alert on failed hosts or partially deployed hosts.


Splunk Employee
Splunk Employee

I'm looking to grab the search that lists what hosts are within a particular serverclass. Any hints?

0 Karma


This is a similar report (although missing the status of apps deployed) taken from another post which can be found here:

index=_internal source=*metrics.log group=tcpin_connections
    | eval sourceHost=if(isnull(hostname), sourceHost,hostname)
    | rename connectionType as connectType
    | eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
    | eval version=if(isnull(version),"pre 4.2",version)
    | rename version as Ver arch as MachType
    | fields connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver MachType os
    | eval Indexer= splunk_server
    | eval Hour=relative_time(_time,"@h")
    | stats sum(kb) as total_KB by Hour connectType Ver sourceIp sourceHost MachType os Indexer destPort
    | fieldformat Hour=strftime(Hour,"%x %X") | fieldformat total_KB=tostring(total_KB,"commas") | rename os as OS
0 Karma


I'm guessing these are rest API calls but I'll let you know if I track them down. Hidden searches/rest commands are always an annoyance to me. IMHO, Splunk should make all reports exportable and able to to open in a search window. The forwarder management report built into Splunk is a perfect example of this.

0 Karma


This seems related, however, I haven't been able to determine the search/call that is assembled behind the scenes.


0 Karma


This is another app you may want to take a look at that has reports/alerts for forwarders and sourcetypes.

alt text

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!