- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- how to identify the forwarder detail
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have 4 Farwarders sending data to indexes how to identify their details while searching
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming you want to know which data containing host is married to the forwarder,
->Check inputs.conf on the host's SplunkHOME/etc/system/local.
->Check other config files.
->Install S.O.S app and look the topology etc.
Like MuS mentioned, all the answers you get would be darts in the dark until you clarify.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry newbie here.. Previous guy that I took over for installed SOS.. when I run topology report yes I can see my servers and forwarders, but in no way tells me if it's a heavy, lite, or universal forwarder. How do I tell?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Data onboarding app is small one and easy to understand the forwarder details and app is available at https://apps.splunk.com/app/1769/
SoS is vey good app (https://apps.splunk.com/app/748/), but it has lots of information beyond forwarders details and you may have to spend sometime to understand the app.
If you just need forwarders information, use Data onboarding app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming you want to know which data containing host is married to the forwarder,
->Check inputs.conf on the host's SplunkHOME/etc/system/local.
->Check other config files.
->Install S.O.S app and look the topology etc.
Like MuS mentioned, all the answers you get would be darts in the dark until you clarify.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
please clarify/specify what details you mean?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
