List of servers sending logs to Heavy forwarder

[Master_Blaster]

Hello All,

We have 20 indexers and 5 HF's in our Environment. HF's are forwarding their data to indexers. I'd need to find out,  which servers are sending logs to HF's. is there any SPL query i can use for same ?
Thanks

[SOURAV_S]

Hi @Master_Blaster ,

Can you check for the following SPL query:

| tstats  values(source) as sources ,values(sourcetype) as sourcetype where index=* by host
| lookup dnslookup clienthost as host OUTPUT  clientip as src_ip

Output of this command would show servers (as per your requirement), with both sourcetype and source information.

If this helps, mark it as answer.

Happy Splunking! 🙂

[scelikok]

Hi @Master_Blaster,

You can use below SPL, please change idx=HF_hostname* with proper matching name to match only HF hosts. 

index=_internal component=TcpOutputProc 
| stats count by host idx 
| where idx=HF_hostname*
| fields - count