Forwarded UDP - Check which forwarder

[SplunkFu]

Hi there,

I'm hoping this is a simple question...

We have 50+ forwarders, and I'm trying to locate the forwarder that passes Syslog traffic to our Indexer, but I can't seem to find the information from Splunk's perspective, is there any where to find this information without looking at the configuration on the source?

Thanks and best regards.

[krugger]

I would suggest running:

netstat -nat | grep 514

If you know the índex which is receiving the syslog data you can query the metadata:

| metadata type=sources índex="yourindeX"

[SplunkFu]

Thanks for the response, however:

1. Running netstat on each box doesn't scale very well, as I don't know which host it is on

2. The metadata command appears to return nothing more than: firstTime; lastTime; recentTime; source; totalCount; type