Getting Data In

How to check how many hosts are connecting (sending logs) to Splunk Forwarder

splunktp
Explorer

Hi Guys,

We have a remote site with a Splunk forwarder installed. How to check how many hosts are connecting (sending logs) to that Splunk Forwarder?

Thanks,

0 Karma

mikelanghorst
Motivator

This app should give you all of the hosts that are connecting/sending data:
http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Deployment Monitor also has searches to alert you when a host stops sending data or if a host starts sending more/less than usual.

A search similiar to this should also work:

* earliest=-24h| dedup host | stats count

0 Karma

tulgabatm
New Member

this command is not working on splunk forwader cli, do you know any other or i'm doing wrong

0 Karma

mikelanghorst
Motivator

Hmm, now that I think about it this won't quite work for the explanation with the forwarder between.

0 Karma

jensenh1999
New Member

How about a query or an update to this App nolonger on splunkbase

0 Karma

splunktp
Explorer

Exactly. Also were using Splunk 4.1.7 (95063).

0 Karma

mikelanghorst
Motivator

so: UF or LF --> Forwarder --> indexer?

0 Karma

splunktp
Explorer

Hosts are sending logs to the forwarder via lightweight forwarder.

0 Karma

mikelanghorst
Motivator

How are the other hosts sending the data to the forwarder?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...