How can I find a listing of all universal forwarders that I have in my Splunk environment?

[johannterc]

Hello. How can I find a listing of all universal forwarders that I have in my Splunk environment?

[jkat54]

| metadata type=hosts | search NOT [ search index=_internal | fields splunk_server | dedup splunk_server | format ]

I feel like there is a field in '| metadata type=hosts' which specifies if it's a forwarder
Or not but the search above might work too.

[ddrillic]

How does your serverclass.conf look on the deployment server? My favorite place ; -)

[masonmorales · Accepted solution]

Here's what I would use:

index=_internal source=*metrics.log* group=tcpin_connections os=* uf  | eval os=os." ".arch | eval version=version." (".build.")" | stats latest(fwdType) AS forwarder_type latest(os) AS os latest(version) AS version by hostname | rename hostname as splunk_forwarder | replace uf with "Universal", full with "Full" in forwarder_type | rename splunk_forwarder as "Splunk Forwarder", forwarder_type as "Forwarder Type", os as "Operating System", version as Version

[skoelpin]

Try this

index=_internal source=*metrics.log group=tcpin_connections
| eval sourceHost=if(isnull(hostname), sourceHost,hostname)