Deployment Architecture

How do I know the name the forwarder for a particular source?

zacksoft_wf
Contributor

I have a particular source/sourcetype ; is there a way to know (through SPL) to get the name of the forwarder from which this particular source feed is coming?

Labels (1)
0 Karma

somesoni2
Revered Legend

You may not be able to find the forwarder name in all cases.

If the data is being forwarded via universal/heavy forwarder and you're not overriding the 'host' metadata, the host would be your forwarder. (index=x sourcetype=y | stats count by host)

If the data is being forwarder via universal/heavy forwarder but host metadata is being overridden, and you're forwarding your _internal logs from UF/HF to your indexers, you could find the forwarder name in the metrics log (index=_internal sourcetype=Splunkd component=MEtrics group=per_sourcetype_thruput series=yourSourceType | stats count by host)

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...