Getting Data In

Find source types from UF to HF...

Explorer

Hi all...one of my Heavy Forwarders is relaying much data, we are using it for an intermediate forwarding tier to Splunk Cloud. Many UFs are sending to this HF.

I need to run a search to find what source types the Universal Forwarders are sending to this Heavy Forwarder.

The Heavy forwarder is not running in preview mode. I've run plenty of searches that report both UF/HF activity to the SH....but I really want to understand what is going to this HF without bouncing it and putting it in local indexing/preview mode.

Thanks for any input...!

0 Karma

Splunk Employee
Splunk Employee

Hi cpraz_ord,

I've got a couple of queries that I like to use for this exact purpose. This is under the assumption that you are forwarding all logs from your on-premise HF into the cloud. It’s not automatic, but you’d start by looking at the _internal index.

This will give you a list of all the sourcetypes that the HF has handled.

index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_sourcetype_thruput | stats values(series)

This will give you a list of all the indexes that the HF has handled.

index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_index_thruput | stats values(series)

That’ll return all the hosts pushing data through the HF.

index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_host_thruput | stats values(series)

Of course, you can use other combinations of | stats to get the formatting you desire, but these are the best starting points to help you start looking in the right places.

edit

I've refined the search a little for you to help you find which of the sourcetypes are the noisiest:

index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_sourcetype_thruput 
|  stats avg(kbps) as kbps by series
|  sort -kbps

Good luck!

0 Karma

Champion

Is HF internal logs are being forwarded to Splunk indexer?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!