Getting List of the Universal forwarders

[ralam]

Hi There,

I wanted to get a list of forwarders from the metric logs. The base logs have confused me a lot. Below is the sample.

For the same hostname "hostname=ip-10-142-xx-29.us-west-2.compute.internal", I see different "sourceIp" & "sourceHost".

Now can anybody help me understand which one is the actual identifier for a forwarder - sourceIp, sourceHost or the hostname?

01-03-2020 16:11:41.894 +0000 INFO  Metrics - group=tcpin_connections, ingest_pipe=1, 10.xx.xx.107:6018:9997, connectionType=cooked, sourcePort=6018, sourceHost=10.xx.xx.107, sourceIp=10.xx.xx.107, destPort=9997, kb=1.6796875, _tcp_Bps=132.10136144345114, _tcp_KBps=0.12900523578462025, _tcp_avg_thruput=0.12900523578462025, _tcp_Kprocessed=1.6796875, _tcp_eps=0.5376218198279988, _process_time_ms=0, evt_misc_kBps=0, evt_raw_kBps=0, evt_fields_kBps=0, evt_fn_kBps=0, evt_fv_kBps=0, evt_fn_str_kBps=0, evt_fn_meta_dyn_kBps=0, evt_fn_meta_predef_kBps=0, evt_fn_meta_str_kBps=0, evt_fv_num_kBps=0, evt_fv_str_kBps=0, evt_fv_predef_kBps=0, evt_fv_offlen_kBps=0, evt_fv_fp_kBps=0, build=8f0ead9ec3db, version=7.1.1, os=xyz, arch=x86_64, hostname=ip-10-142-xx-29.us-west-x.compute.internal, fwdType=uf, ssl=true, lastIndexer=None, ack=true

[codebuilder]

If you're using indexer discovery, the DMC on the Master will show you the entire list of forwarders, including those sending internal logs.

[jscraig2006]

Splunk Base has a nice app for this. Utilization Monitor for Splunk Utilization Monitor for Splunk

Also to answer your question fwdType=ufwill tell you that it is a Universal Forwarder,