Get entity list of just splunk infrastructure servers

[brent_weaver]

I would like to know the query I can use to get JUST the splunk infra servers, and not the UF's. I want to use this in iTSI for entities. Thanks!

[harsmarvania57]

Hi,

If all of your Splunk Enterprise Servers sending data to Indexers then you can use below query to find out Splunk Enterprise Servers

index=_internal source=/opt/splunk/var/log/splunk/metrics.log* group=tcpin_connections fwdType=full | dedup hostname | table hostname os arch version sourceIp destPort fwdType ssl

[brent_weaver]

Hey there, THANK YOU for taking the time to respond, but I was not clear in asking. I am just looking for the servers that make up my splunk infra, like the indexers, the search heads and the HWF's. I do see your point fwdType=full, is that the special sauce to make this work?

[harsmarvania57]

fwdType=full will provide you list of Splunk Enterprise Servers only but you will able not get type of servers whether it is Search Head, Indexers or Heavy Forwarders. Maybe you can use static lookup and map server with that lookup file for functionality of the server.