Getting Data In

How to check how many hosts are connecting (sending logs) to Splunk Forwarder

splunktp
Explorer

Hi Guys,

We have a remote site with a Splunk forwarder installed. How to check how many hosts are connecting (sending logs) to that Splunk Forwarder?

Thanks,

0 Karma

mikelanghorst
Motivator

This app should give you all of the hosts that are connecting/sending data:
http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Deployment Monitor also has searches to alert you when a host stops sending data or if a host starts sending more/less than usual.

A search similiar to this should also work:

* earliest=-24h| dedup host | stats count

0 Karma

tulgabatm
New Member

this command is not working on splunk forwader cli, do you know any other or i'm doing wrong

0 Karma

mikelanghorst
Motivator

Hmm, now that I think about it this won't quite work for the explanation with the forwarder between.

0 Karma

jensenh1999
New Member

How about a query or an update to this App nolonger on splunkbase

0 Karma

splunktp
Explorer

Exactly. Also were using Splunk 4.1.7 (95063).

0 Karma

mikelanghorst
Motivator

so: UF or LF --> Forwarder --> indexer?

0 Karma

splunktp
Explorer

Hosts are sending logs to the forwarder via lightweight forwarder.

0 Karma

mikelanghorst
Motivator

How are the other hosts sending the data to the forwarder?

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...