Getting Data In

Is there a search to centrally list what my universal forwarders are monitoring?

lycollicott
Motivator

I know that I can use curl to query the API

curl -k -u admin:pass https://localhost:8089/services/data/inputs/monitor 

but is there a way to get such information directly from search?

0 Karma
1 Solution

lycollicott
Motivator

I used PowerShell to loop through a list of my servers and run "splunk list monitor -auth admin:xxxxxxx" on all of them.

View solution in original post

0 Karma

dominiquevocat
Motivator

You could install this app https://splunkbase.splunk.com/app/2775/
and then do this search:
| metadata type=hosts index=_internal| fields host | forwarderquerystreaming api="/services/data/inputs/monitor" | spath input=returnvalue | fields host,feed.entry.title

lycollicott
Motivator

I used PowerShell to loop through a list of my servers and run "splunk list monitor -auth admin:xxxxxxx" on all of them.

0 Karma

lguinn2
Legend

The search heads and indexers have no information about the actual configuration (inputs.conf, etc.) of a forwarder. At most, you can search to see what data has arrived and how much has been sent by each forwarder - but you can't search to see what has been configured.

You could query the API of the forwarder - replace localhost:8089 with the name and splunkd port number of the forwarder. For example, if the forwarder is 10.10.4.204 and splunkd is running on port 8089 -

| rest https://10.10.4.204:8089 /services/data/inputs/monitor

You may have to do a rest command to authenticate with the forwarder before this will work...

lycollicott
Motivator

I already tried various combinations of REST...

| rest https://master_1:8089/services/data/inputs/monitor | table host
| rest https://peer_1:8089/services/data/inputs/monitor | table host
| rest https://peer_2:8089/services/data/inputs/monitor | table host
| rest https://uf_1:8089/services/data/inputs/monitor | table host

but they all return the exact same data....

host title

peer_1 $SPLUNK_HOME\/etc\/splunk.version

peer_1 $SPLUNK_HOME\/var\/log\/introspection

peer_1 $SPLUNK_HOME\/var\/log\s/plunk

peer_1 $SPLUNK_HOME\/var\/spool\/splunk

peer_1 $SPLUNK_HOME\/var\/spool\/splunk./..stash_new

lycollicott
Motivator

BTW, I tried the following, but it returned results about one of the indexers and nothing at all about a UF.

| rest /services/data/inputs/monitor | table host, title, index

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...