Getting Data In

Is there a way to list the incoming data feeds?

joshgoodall
New Member

Hello, I'm rather new to Splunk and have taken over an existing system we use for very base level SysLog monitoring (less than 40mb/day). What I'm trying to figure out is if there is a way to search the system to determine which devices are feeding into the system.

My initial thought is to have a dashboard with a count/list of devices feeding in and then ultimately to calculate the amount of data each device is feeding in. I've done some google and splunk searches but haven't been able to locate what I'm looking for.

Thank you,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started. It will show how many events you get from each host that sends to Splunk. It assumes host names are those of the original devices rather than the syslog server. For better performance, change "index=*" to a specific index name where your syslog data resides.

| tstats count where index=* by host

If you haven't already, you may want to check out "Inherit a Splunk Enterprise Deployment" in Splunk docs (https://docs.splunk.com/Documentation/Splunk/7.2.6/InheritedDeployment/Introduction).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...