Getting Data In

What does this Forwarder Management pop up mean?

domino30
Path Finder

forwarder management.PNG

 When I see this screen I think ... this is where all my forwarder  are any that I've added no matter the means will show up here and I can see their status.

How wrong am I?

 

also technically could you have lets say 2 forwarder but 20 machines sending data to those forwarder  and then those forwarders sending data to your indexers where you can then  uses app or searches to make sense of that data?

Labels (1)
0 Karma
1 Solution

chaker
Contributor

1: If you want your forwarders to show up there, you need to run the following command:

https://docs.splunk.com/Documentation/Splunk/9.0.0/Updating/Configuredeploymentclients

splunk set deploy-poll <IP_address/hostname>:<management_port>
splunk restart

This will update a file called deploymentclient.conf on your universal forwarders. In a production environment, you would deploy that file in an app or have the app already packaged with the OS image, but the above command will still work.

2:  If you have 2 forwarders, each receiving data feeds from other hosts/devices, you will need to use Splunk metadata field "host".  This can be done by either manually setting a value per input, or having a value extracted from a filename or filepath. 

It is possible to set the host name based on the content of the event, but you will need to do this on your indexer or heavy forwarder, and universal forwarder will not work.

https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Overridedefaulthostassignments

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @domino30,

in addition to the correct answer of @chaker, I add that you can use the Monitoring Console to see all the Forwarders that are sending data to your Splunk infrastructure.

The screenshot you shared displays the managed Forwarders, not the sending data Forwarders, in your case, if you have two intermediate Forwarders and twenty final Forwarders, you'll seein this dashboard only the two intermediate Forwarders and in Monitoring console all the 22 Forwarders.

As I said, to have the list of sending data forwarders, you have to use the Monitoring Console or run a search like this:

| metasearch index=_internal
| stats count BY host

Ciao.

Giuseppe

chaker
Contributor

1: If you want your forwarders to show up there, you need to run the following command:

https://docs.splunk.com/Documentation/Splunk/9.0.0/Updating/Configuredeploymentclients

splunk set deploy-poll <IP_address/hostname>:<management_port>
splunk restart

This will update a file called deploymentclient.conf on your universal forwarders. In a production environment, you would deploy that file in an app or have the app already packaged with the OS image, but the above command will still work.

2:  If you have 2 forwarders, each receiving data feeds from other hosts/devices, you will need to use Splunk metadata field "host".  This can be done by either manually setting a value per input, or having a value extracted from a filename or filepath. 

It is possible to set the host name based on the content of the event, but you will need to do this on your indexer or heavy forwarder, and universal forwarder will not work.

https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Overridedefaulthostassignments

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...