In the search head, why am I not able to see which heavy forwarder the logs are coming from?

[kunalg]

I have 3 heavy forwarders and sending firewall logs to all heavy forwarders and then forwarder to indexer. But, when I am searching from the search head, I am not able to check from which heavy forwarder the logs were forwarded from.

[FrankVl]

As @Colin Humphreys already mentions, this is not explicitly stored in any field by Splunk. But since you are using a file monitor input, this can be accomplished relatively easily, by placing the log files into a folder that contains the forwarder name. Since the file path is stored in the source field, you can use that to determine which forwarder processed the event.

If you cannot or do not want to change the actual location of the log files on disk, you can also create a symlink (named after the respective forwarder) to the respective folder and point Splunk at that symlink.

[datasearchninja]

By default, there is no field stored in the data that indicates which splunk instance that parsed/cooked the data.

You only have splunk_server which is the indexer where the data for that search is on disk, and the host field which will be the source of the data, unless you have overwritten the host field with a transform, or explicitly set it to something else in inputs.conf. (And this is likely the case where you are receiving firewall logs)

If this is really a requirement, you could create an additional indexed field (in the example below I call this splunk_parser) to store the data.

On the heavy forwarder, in inputs.conf:

[default]
_meta = splunk_parser::<ENTERYOURHEAVYFORWARDERNAMEHERE>

On your search head, configure fields.conf to let splunk know this is an indexed field:

[splunk_parser]
INDEXED = True
INDEXED_VALUE = False

[kunalg]

Thanks man!
I have updated as suggested and getting the heavy forwarders information in field

[493669]

how you have created input..is it from data inputs? or used any add-on?

[kunalg]

Add-on on search head

[493669]

you are taking data from forwarder to indexer so you must have created data input on your forwarder...
can you please provide details about inputs.conf for firewall logs created

[kunalg]

Sorry, due to some issues I am not able to provide you inputs.conf but I don't think so this is required as I am receiving the logs... Only problem is not able to find from which heavy forwarder, specific log is coming by searching firewall logs on search head

[kunalg]

And yes using file monitoring method to collect logs

[493669]

also which add-on you are using?