Getting Data In
Highlighted

Forwarded UDP - Check which forwarder

Path Finder

Hi there,

I'm hoping this is a simple question...

We have 50+ forwarders, and I'm trying to locate the forwarder that passes Syslog traffic to our Indexer, but I can't seem to find the information from Splunk's perspective, is there any where to find this information without looking at the configuration on the source?

Thanks and best regards.

Tags (3)
0 Karma
Highlighted

Re: Forwarded UDP - Check which forwarder

Communicator

I would suggest running:

netstat -nat | grep 514

If you know the índex which is receiving the syslog data you can query the metadata:

| metadata type=sources índex="yourindeX"

0 Karma
Highlighted

Re: Forwarded UDP - Check which forwarder

Path Finder

Thanks for the response, however:

  1. Running netstat on each box doesn't scale very well, as I don't know which host it is on

  2. The metadata command appears to return nothing more than: firstTime; lastTime; recentTime; source; totalCount; type

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.