Getting Data In

Is there a way to list the incoming data feeds?

joshgoodall
New Member

Hello, I'm rather new to Splunk and have taken over an existing system we use for very base level SysLog monitoring (less than 40mb/day). What I'm trying to figure out is if there is a way to search the system to determine which devices are feeding into the system.

My initial thought is to have a dashboard with a count/list of devices feeding in and then ultimately to calculate the amount of data each device is feeding in. I've done some google and splunk searches but haven't been able to locate what I'm looking for.

Thank you,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started. It will show how many events you get from each host that sends to Splunk. It assumes host names are those of the original devices rather than the syslog server. For better performance, change "index=*" to a specific index name where your syslog data resides.

| tstats count where index=* by host

If you haven't already, you may want to check out "Inherit a Splunk Enterprise Deployment" in Splunk docs (https://docs.splunk.com/Documentation/Splunk/7.2.6/InheritedDeployment/Introduction).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...