Hi all...one of my Heavy Forwarders is relaying much data, we are using it for an intermediate forwarding tier to Splunk Cloud. Many UFs are sending to this HF.
I need to run a search to find what source types the Universal Forwarders are sending to this Heavy Forwarder.
The Heavy forwarder is not running in preview mode. I've run plenty of searches that report both UF/HF activity to the SH....but I really want to understand what is going to this HF without bouncing it and putting it in local indexing/preview mode.
I've got a couple of queries that I like to use for this exact purpose. This is under the assumption that you are forwarding all logs from your on-premise HF into the cloud. It’s not automatic, but you’d start by looking at the _internal index.
This will give you a list of all the sourcetypes that the HF has handled.