I have found different articles that query and return information about universal forwarders. But I am trying to get a list of heavy forwarders that the splunk system has. Does anyone have a simple script that would give me a list of all heavy forwarders.
unfortunately my logs don't go back long enough. I try the query but since my logs don't go back that far it does not provide me with information.
If your logs go back far enough to capture when the HFs started then this may get you started.
index=_internal component=ServerRoles "Declared role"
| stats values(role) as roles by host