list host, source by forwarder

[dominiquevocat]

How do i get a list comprising the fields host, source for each forwarder.

Background: the admins of the machines where the forwarder runs on seem to have made mistakes when adding a monitor and i would like to identify which ones are wrong and provide a clearing list.
The field that is wrong is unfortunately "host". By identifying which "host,source" by forwarder i can tell which forwarder needs to be corrected.

[MuS]

Hi dominiquevocat,

because it is fun to play around in Splunk and always look for other ways to get the results, try this:

 index=_internal ( source=*license_usage.log type!=*Summary ) OR ( source=*metrics.log group=tcpin_connections fwdType=uf ) | streamstats last(sourceIp) AS last_ip last(hostname) AS last_hostname | where h=last_hostname | stats values(last_ip) AS IP values(st) AS sourcetype values(s) AS source by h | rename h AS Host

This will give you a nice table view of each Hosts Name, IP used, sourcetype used and sources used.

hope this helps ...

cheers, MuS

[MuS]

HeHe, try to limit the base search by using snippets of the source name or ip or hostname 😉

[dominiquevocat]

looks nice! perhaps due to the large amount of files on one of the hosts it stops after some 30'000 or so sources...

[strive]

Try this

|metasearch host=* | dedup source | table host, source

[dominiquevocat]

nope, because the value in "host" is the wrong one (overridden value) and i need to ip or hostname of the forwarder where this came from.

[strive]

Ok. In any case, the above search in my comment should work. are you seeing any issues with the search?

[dominiquevocat]

i have reason to suspect, that the guy indexing files specified the host when doing "add monitor" on the command line.

[strive]

Are you configuring what should be host in inputs.conf? If not the host name set on the device will be taken automatically.

[strive]

The above search should work for your needs. In case if you need splunk server details also then do this

|metasearch host=* | dedup source | table host, source, splunk_server

[dominiquevocat]

I updated the question, sorry. The field that is wrong is "host"...