Getting Data In

How do I get hosts (universal forwarders) show on the Splunk Light home page?

New Member

I have Splunk Light installed and set up on my server. I have the receiving port set. On the client I want Splunk Light to monitor, I have installed the Universal Forwarder and pointed it to the Splunk Light server and port. On the Splunk light server I have added the forwarder, but on the Splunk Light home page, under the Hosts column, the client computer is not getting listed. What am I missing?

0 Karma

Splunk Employee
Splunk Employee

i think the hosts listing on the home page derives it's values from the data that's been ingested, namely the "host=" field. If no data has been sent by the forwarder(s) in question, then it/they will not appear in the listing. Additionally, if a forwarder is sending data but that data already has a "host" field in it, that value may preclude the forwarders inclusion in the list. If a global search "*" returns data/events then look at the hosts value attached to them. Those values should be listed on the home page.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...