Getting Data In

How to tell what kind of forwarders in the environment?

lguinn2
Legend

I am new to a Splunk environment, and there are a lot of forwarders running. How can identify which forwarders are Universal Forwarders or Light Forwarders or Heavy Forwarders?

I want to configure timezone information in props.conf, but I am not sure where to put it.

Tags (1)
1 Solution

rroberts
Splunk Employee
Splunk Employee

search Index=_internal tcpin*

fwdType field holds forwarder type.

For example:
group=tcpin_connections, 204.236.145.235:54219:9997, connectionType=cooked, sourcePort=54219, sourceHost=204.236.145.235, sourceIp=204.236.145.235, destPort=9997, _tcp_Bps=24.84, _tcp_KBps=0.02, _tcp_avg_thruput=0.11, kb=0.75, _tcp_Kprocessed=4.79, _tcp_eps=0.06, build=128297, version=4.3.3, os=Linux, arch=x86_64, hostname=ip-10-166-186-254-archStudent, guid=2BEF811B-5EEB-469B-AD71-52A8FD6ECD00, fwdType=uf, ssl=false, lastIndexer=50.18.74.20:9997, ack=false

View solution in original post

lguinn2
Legend

The indexers keep status info about every contact they have with forwarders. This is stored in the Splunk metrics.log, and is accessible in the _internal index. You can run this search to get some info about the forwarders:

index=_internal source=*metrics.log group=tcpin_connections 
| eval sourceHost=if(isnull(hostname), sourceHost,hostname) 
| dedup sourceHost
| eval connectionType =case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectionType=="cooked" or connectionType =="cookedSSL","Splunk fwder", connectionType =="raw" or connectionType =="rawSSL","legacy fwder")
| eval version=if(isnull(version),"pre 4.2",version)
| table connectionType sourceIp sourceHost destPort version

And BTW, you could put the same props.conf on all the forwarders and indexers. The universal forwarders and light forwarders will simply ignore any settings (like timezone) that are related to parsing.

bmacias84
Champion

Hello lguinn,

Youc an use the metrics.log to gather info on your forwarder topology.

Here a quick sample:


index=_internal source="$SPLUNK_HOME/Splunk/var/log/splunk/metrics.log*" sourcetype="splunkd" fwdType="*" | dedup sourceHost|table sourceHost, hostname, fwdType, guid, os, arch

OUTPUT:

sourceHost hostname fwdType guid os arch
1 xxx.xxx.xx.135 SERVER02 uf 57xxxxx9-016D-4xxx3-xxC8-BA2xxxxxx46 Linux x64

2 xx.xxx.xxx.167 DESKTOP01 uf xxxx48506-BAED-4xxxA-8xxx5-13Fxxxxxxx00 Windows x64


fwdType should contain the different forwarder types in your enviornment. As for configuring timezones. You would place in inthe props.conf file on your indexers.

Example:


#this will apply to all host start with RIFDE to eastcoast
[host::RIFDE*]
TZ = US/Eastern
OR
[source::.../delaware/web_access.log]
TZ = US/Eastern

Hope this helps you. cheers.

rroberts
Splunk Employee
Splunk Employee

search Index=_internal tcpin*

fwdType field holds forwarder type.

For example:
group=tcpin_connections, 204.236.145.235:54219:9997, connectionType=cooked, sourcePort=54219, sourceHost=204.236.145.235, sourceIp=204.236.145.235, destPort=9997, _tcp_Bps=24.84, _tcp_KBps=0.02, _tcp_avg_thruput=0.11, kb=0.75, _tcp_Kprocessed=4.79, _tcp_eps=0.06, build=128297, version=4.3.3, os=Linux, arch=x86_64, hostname=ip-10-166-186-254-archStudent, guid=2BEF811B-5EEB-469B-AD71-52A8FD6ECD00, fwdType=uf, ssl=false, lastIndexer=50.18.74.20:9997, ack=false

lguinn2
Legend

Dang, I have to type my own answer faster!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...