Is it possible to Identify splunk forwarder location ?

[AKG1_old1]

Hello,

we have plenty of forwarders install at different machine/folders. Is there any way to list out all forwarders location ?

I have tried below apps but no one provide location for forwarder, Just getting IP of forwarder Machine.

1. Unified Forwarder Monitoring App for Splunk
   https://splunkbase.splunk.com/app/3805/

2. Monitoring Console

Some Example location:
/net/hp754srv/hp754srv1/apps/ENV1/splunkforwarder1
/net/dell443srv/dell443srv3/apps/ENV2/splunkforwarder2
/net/dell153srv/dell153srv2/apps/ENV3/splunkforwarder3

Thanks

[harsmarvania57 · Accepted solution]

Hi @agoyal,

If forwarders are sending internal logs to splunk indexers then you can try below query.

index=_internal sourcetype=splunkd 
| stats count by source,host
| regex source="(?:\/|\x5c)splunkd\.log$"
| rex field=source "(?<installation_path>.*)(?:\/|\x5c)var(?:\/|\x5c)"

[inventsekar]

1. Not sure of what is the "location" here (physical location or some logical location)

Some Example location:
/net/hp754srv/hp754srv1/apps/ENV1/splunkforwarder1

1. "If the forwarders are sending their internal logs"...... The forwarders will be sending their internal logs always, right?!?!
2. On this command, why regex and rex both are used?!?! (I am not having access to any splunk systems, or i should have tested these myself)

[harsmarvania57]

1. Location means on which path SplunkForwarder is installed on different servers irrrespective of whether it's physical or virtual machine.
2. It depends, you can disable Splunk Universal Forwarder internal logging. For exa. If you are working on large environment like 20-30K Forwarders and if you do not want to ingest Forwarder internal logs then you can disable it.
3. There are 2 approach either you can provide source=*splunkd.log in base search but I heard that wildcard ( * ) at starting is not good so I am using regex and rex in above query. regex filter out splunkd.log and rex command extract installation path.

[AKG1_old1]

@harsmarvania57 : Thanks!! it worked like a charm 🙂

[harsmarvania57]

You're welcome. Glad that it worked 🙂