Getting Data In

How to check how many hosts are connecting (sending logs) to Splunk Forwarder

splunktp
Explorer

Hi Guys,

We have a remote site with a Splunk forwarder installed. How to check how many hosts are connecting (sending logs) to that Splunk Forwarder?

Thanks,

0 Karma

mikelanghorst
Motivator

This app should give you all of the hosts that are connecting/sending data:
http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Deployment Monitor also has searches to alert you when a host stops sending data or if a host starts sending more/less than usual.

A search similiar to this should also work:

* earliest=-24h| dedup host | stats count

0 Karma

tulgabatm
New Member

this command is not working on splunk forwader cli, do you know any other or i'm doing wrong

0 Karma

mikelanghorst
Motivator

Hmm, now that I think about it this won't quite work for the explanation with the forwarder between.

0 Karma

jensenh1999
New Member

How about a query or an update to this App nolonger on splunkbase

0 Karma

splunktp
Explorer

Exactly. Also were using Splunk 4.1.7 (95063).

0 Karma

mikelanghorst
Motivator

so: UF or LF --> Forwarder --> indexer?

0 Karma

splunktp
Explorer

Hosts are sending logs to the forwarder via lightweight forwarder.

0 Karma

mikelanghorst
Motivator

How are the other hosts sending the data to the forwarder?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...