Find source types from UF to HF...

[cpraz_ord]

Hi all...one of my Heavy Forwarders is relaying much data, we are using it for an intermediate forwarding tier to Splunk Cloud. Many UFs are sending to this HF.

I need to run a search to find what source types the Universal Forwarders are sending to this Heavy Forwarder.

The Heavy forwarder is not running in preview mode. I've run plenty of searches that report both UF/HF activity to the SH....but I really want to understand what is going to this HF without bouncing it and putting it in local indexing/preview mode.

Thanks for any input...!

[jajung]

Hi cpraz_ord,

I've got a couple of queries that I like to use for this exact purpose. This is under the assumption that you are forwarding all logs from your on-premise HF into the cloud. It’s not automatic, but you’d start by looking at the _internal index.

This will give you a list of all the sourcetypes that the HF has handled.

index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_sourcetype_thruput | stats values(series)

This will give you a list of all the indexes that the HF has handled.

index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_index_thruput | stats values(series)

That’ll return all the hosts pushing data through the HF.

index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_host_thruput | stats values(series)

Of course, you can use other combinations of | stats to get the formatting you desire, but these are the best starting points to help you start looking in the right places.

edit

I've refined the search a little for you to help you find which of the sourcetypes are the noisiest:

index=_internal sourcetype=splunkd host=<heavyforwardername> group=per_sourcetype_thruput 
|  stats avg(kbps) as kbps by series
|  sort -kbps

Good luck!

[p_gurav]

Is HF internal logs are being forwarded to Splunk indexer?