Deployment Architecture

How to detect duplicate GUIDs on forwarders?

davidpaper
Contributor

There are a number of posts on how to fix duplicate GUIDs on FWDs (https://answers.splunk.com/answers/32368/duplicate-guids-for-cloned-forwarders-how-to-correct.html) but there are none for how to detect them to begin with.

How do I find duplicate GUIDs on forwarders?

1 Solution

davidpaper
Contributor

The DMC gets us most of the way there with the Forwarder management views. Some tweaking gets us here.

index=_internal | dedup hostname
| search NOT [| inputlookup dmc_assets | dedup serverName | rename serverName as hostname | fields hostname]
| stats count(guid), values(hostname) by guid | sort - count(guid)

View solution in original post

johnlee2327
Engager

I think the SPL and the concept of Davidpaper are good. But for some reason, in my environment, it will not be able to reveal all the hidden problems. My SPL is as follows, I hope people with the same problem can give it a try. It fix my problem. 

index=_internal ClientSessionsManager
| stats dc(hostname), values(hostname) by instanceId
| sort - dc(hostname)

cbright
Explorer

Sorry I know this is an older post but I was looking to do this as well and came up with this search that will show you any clients with the same GUID and the same name and only display multiples:

index=_internal|dedup sourceIp
| search NOT [| inputlookup dmc_assets | dedup serverName | rename serverName as hostname | fields hostname]
| stats count(guid) AS dupguid, values(hostname), values(sourceIp) by guid|search dupguid > 1

0 Karma

davidpaper
Contributor

The DMC gets us most of the way there with the Forwarder management views. Some tweaking gets us here.

index=_internal | dedup hostname
| search NOT [| inputlookup dmc_assets | dedup serverName | rename serverName as hostname | fields hostname]
| stats count(guid), values(hostname) by guid | sort - count(guid)

acharlieh
Influencer

Another interesting statistic along these lines from that same Metrics log may be values(sourceIp) which I wonder if the assets table would help you or not...

0 Karma

dwaddle
SplunkTrust
SplunkTrust

There's also a tell-tale message at deployment server where you see something like "GUID XXX-XXX-XX has changed attributes to " .. I'll have to find one

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...