Is there a way to list the incoming data feeds?

[joshgoodall]

Hello, I'm rather new to Splunk and have taken over an existing system we use for very base level SysLog monitoring (less than 40mb/day). What I'm trying to figure out is if there is a way to search the system to determine which devices are feeding into the system.

My initial thought is to have a dashboard with a count/list of devices feeding in and then ultimately to calculate the amount of data each device is feeding in. I've done some google and splunk searches but haven't been able to locate what I'm looking for.

Thank you,

[richgalloway]

This should get you started. It will show how many events you get from each host that sends to Splunk. It assumes host names are those of the original devices rather than the syslog server. For better performance, change "index=*" to a specific index name where your syslog data resides.

| tstats count where index=* by host

If you haven't already, you may want to check out "Inherit a Splunk Enterprise Deployment" in Splunk docs (https://docs.splunk.com/Documentation/Splunk/7.2.6/InheritedDeployment/Introduction).