Getting Data In

Need help with splunk SPL or REST API

AK_Splunk
Explorer

Need help with splunk SPL or rest api to fetch areport where we can see the count of total servers(splunk universal forwarders) reporting to IDX and HF with breakup.

Some UF are sending data to IDXers directly and few of them are sending it via HF(due to some connection issues we have followed this architecture)

Please assist me on the same.

Labels (1)
0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @AK_Splunk 

can you run  query1 or query2 search in search head , hope one of helps your requriment 

Query1

index=_internal source="*metrics.log" group="tcpin_connections"
| dedup hostname
| rename host as "receiver host" hostname as "sender host"
| table _time "sender host" connectionType version sourceIp destPort ssl fwdType "receiver host" 


Query2

index=_internal source="*metrics.log" host IN (UF1,UF2) 
group=tcpout_connections
| stats count by host destIp destPort

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...