Getting Data In

Is there a way to list the incoming data feeds?

joshgoodall
New Member

Hello, I'm rather new to Splunk and have taken over an existing system we use for very base level SysLog monitoring (less than 40mb/day). What I'm trying to figure out is if there is a way to search the system to determine which devices are feeding into the system.

My initial thought is to have a dashboard with a count/list of devices feeding in and then ultimately to calculate the amount of data each device is feeding in. I've done some google and splunk searches but haven't been able to locate what I'm looking for.

Thank you,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started. It will show how many events you get from each host that sends to Splunk. It assumes host names are those of the original devices rather than the syslog server. For better performance, change "index=*" to a specific index name where your syslog data resides.

| tstats count where index=* by host

If you haven't already, you may want to check out "Inherit a Splunk Enterprise Deployment" in Splunk docs (https://docs.splunk.com/Documentation/Splunk/7.2.6/InheritedDeployment/Introduction).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...