How do i get a list comprising the fields host, source for each forwarder.
Background: the admins of the machines where the forwarder runs on seem to have made mistakes when adding a monitor and i would like to identify which ones are wrong and provide a clearing list.
The field that is wrong is unfortunately "host". By identifying which "host,source" by forwarder i can tell which forwarder needs to be corrected.
because it is fun to play around in Splunk and always look for other ways to get the results, try this:
index=_internal ( source=*license_usage.log type!=*Summary ) OR ( source=*metrics.log group=tcpin_connections fwdType=uf ) | streamstats last(sourceIp) AS last_ip last(hostname) AS last_hostname | where h=last_hostname | stats values(last_ip) AS IP values(st) AS sourcetype values(s) AS source by h | rename h AS Host
This will give you a nice table view of each Hosts Name, IP used, sourcetype used and sources used.
hope this helps ...
HeHe, try to limit the base search by using snippets of the source name or ip or hostname 😉
looks nice! perhaps due to the large amount of files on one of the hosts it stops after some 30'000 or so sources...
|metasearch host=* | dedup source | table host, source
nope, because the value in "host" is the wrong one (overridden value) and i need to ip or hostname of the forwarder where this came from.
Ok. In any case, the above search in my comment should work. are you seeing any issues with the search?
i have reason to suspect, that the guy indexing files specified the host when doing "add monitor" on the command line.
Are you configuring what should be host in inputs.conf? If not the host name set on the device will be taken automatically.
The above search should work for your needs. In case if you need splunk server details also then do this
|metasearch host=* | dedup source | table host, source, splunk_server
I updated the question, sorry. The field that is wrong is "host"...