Is there a search to centrally list what my universal forwarders are monitoring?

[lycollicott]

I know that I can use curl to query the API

curl -k -u admin:pass https://localhost:8089/services/data/inputs/monitor 

but is there a way to get such information directly from search?

[dominiquevocat]

You could install this app https://splunkbase.splunk.com/app/2775/
and then do this search:
| metadata type=hosts index=_internal| fields host | forwarderquerystreaming api="/services/data/inputs/monitor" | spath input=returnvalue | fields host,feed.entry.title

[lycollicott · Accepted solution]

I used PowerShell to loop through a list of my servers and run "splunk list monitor -auth admin:xxxxxxx" on all of them.

[lguinn2]

The search heads and indexers have no information about the actual configuration (inputs.conf, etc.) of a forwarder. At most, you can search to see what data has arrived and how much has been sent by each forwarder - but you can't search to see what has been configured.

You could query the API of the forwarder - replace localhost:8089 with the name and splunkd port number of the forwarder. For example, if the forwarder is 10.10.4.204 and splunkd is running on port 8089 -

| rest https://10.10.4.204:8089 /services/data/inputs/monitor

You may have to do a rest command to authenticate with the forwarder before this will work...

[lycollicott]

I already tried various combinations of REST...

| rest https://master_1:8089/services/data/inputs/monitor | table host
| rest https://peer_1:8089/services/data/inputs/monitor | table host
| rest https://peer_2:8089/services/data/inputs/monitor | table host
| rest https://uf_1:8089/services/data/inputs/monitor | table host

but they all return the exact same data....

host title

peer_1 $SPLUNK_HOME\/etc\/splunk.version

peer_1 $SPLUNK_HOME\/var\/log\/introspection

peer_1 $SPLUNK_HOME\/var\/log\s/plunk

peer_1 $SPLUNK_HOME\/var\/spool\/splunk

peer_1 $SPLUNK_HOME\/var\/spool\/splunk./..stash_new

[lycollicott]

BTW, I tried the following, but it returned results about one of the indexers and nothing at all about a UF.

| rest /services/data/inputs/monitor | table host, title, index