Getting Data In

How to get Splunk UF versions in Intermediate forwarder set up?

dmcintosh1972
Explorer

Hi can anyone think of a way to get Splunk versions reported from universal forwarders when in a Intermediate forwarder environment.

I have tried searches like 

index=_internal sourcetype=splunkd group=tcpin_connections
but it only returns the agent version of the intermediate layer, not the UF versions behind it.

Are there any commands that can be deployed via to each UF to collect that information?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The intermediate forwarders should be logging the tcpin_connection events they get from UFs (at least if they're heavy forwarders).  Check that they are forwarding their logs

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

dmcintosh1972
Explorer

Hi

FYI

limits.conf
[metrics:tcpin_connections]
aggregate_metrics = true

this setting will aggregate the data being received on the Intermediate forwarders so does not report the individual servers.

0 Karma

dmcintosh1972
Explorer

thanks for your help, not sure if i need to enable something. to log more metrics?
from UF i only see the group fields per_host_thruput, instance.

The group=tcpin_connections are only logged under my cloud indexers and the hostnames covered are the cloud infrastructure and the IUF's, now other UF servers.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The intermediate forwarders should be logging the tcpin_connection events they get from UFs (at least if they're heavy forwarders).  Check that they are forwarding their logs

---
If this reply helps you, Karma would be appreciated.
0 Karma

isoutamo
SplunkTrust
SplunkTrust

UFs are reporting their version just like IUFs, just check/add their name to your query.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...