What does this Forwarder Management pop up mean?

[domino30]

 When I see this screen I think ... this is where all my forwarder  are any that I've added no matter the means will show up here and I can see their status.

How wrong am I?

also technically could you have lets say 2 forwarder but 20 machines sending data to those forwarder  and then those forwarders sending data to your indexers where you can then  uses app or searches to make sense of that data?

[gcusello]

Hi @domino30,

in addition to the correct answer of @chaker, I add that you can use the Monitoring Console to see all the Forwarders that are sending data to your Splunk infrastructure.

The screenshot you shared displays the managed Forwarders, not the sending data Forwarders, in your case, if you have two intermediate Forwarders and twenty final Forwarders, you'll seein this dashboard only the two intermediate Forwarders and in Monitoring console all the 22 Forwarders.

As I said, to have the list of sending data forwarders, you have to use the Monitoring Console or run a search like this:

| metasearch index=_internal
| stats count BY host

Ciao.

Giuseppe

[chaker · Accepted solution]

1: If you want your forwarders to show up there, you need to run the following command:

https://docs.splunk.com/Documentation/Splunk/9.0.0/Updating/Configuredeploymentclients

splunk set deploy-poll <IP_address/hostname>:<management_port>

splunk restart

This will update a file called deploymentclient.conf on your universal forwarders. In a production environment, you would deploy that file in an app or have the app already packaged with the OS image, but the above command will still work.

2:  If you have 2 forwarders, each receiving data feeds from other hosts/devices, you will need to use Splunk metadata field "host".  This can be done by either manually setting a value per input, or having a value extracted from a filename or filepath. 

It is possible to set the host name based on the content of the event, but you will need to do this on your indexer or heavy forwarder, and universal forwarder will not work.

https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Overridedefaulthostassignments