Help locating what forwarder data is coming from

[jbleich]

I'm a new splunk user, so be kind 🙂

I have about 80% of my daily volume coming in what i believe to be un-needed informaton. I cant tell where the data is coming from, all i know is index=main and sourcetype=Perfmon:process

Now i thought it was the universal forwarders on my DC's, I have 2 of them and pushed out the app via the deployment server and i changed the .conf file to disable Perfmon:process, but apparently that wasnt it...it must be coming from somewhere else.

Any help would be appreciated.

[jbleich]

I know what server it's coming from I'm trying to find out if it's some default data from the universal forwarder, from the windows infrastructure app, or from the VMware app we have loaded.

I dont think it's the vmware app because it splits their sourcetypes into vmware:something...

So I think it's either the default or the infrastrcture app.

I have suspicions it's the default forwarder actions, but if that's the case why wouldnt every server i have the forwarder on send perfmon data, unless it's because these 2 are my DCs.

In any event Im more interested in blocking it.

[linu1988]

Hello,
below is the fastest way to get the time and host which is responsible for the data.

|metadata type=hosts index=*

It shows you the first and latest received event time and number of events. So try this.

Thanks,
L

[strive]

somesoni2 has already pointed what you need to check.

index=main | dedup host | table host

[somesoni2]

There should be a field host which should tell you from which server its coming from.