Installation

Heavy Forwarder iNSTALLED OR NOT

umeshcreddy
Engager

 I  have asked to Add the new Linux HFs to the forwarding configurations and ensure that logs are passing through them 

how to verify the condition is met or not 

Labels (1)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @umeshcreddy,

let me understand:

  • do you want to know if you're receiving logs from that HF
  • or do you want to know if the logs passing through the HF arrive to the Indexers?

in the first case run on Search Heads  the following search:

(index=_internal OR index=*) host=HF_hostname

 If instead your HF is a concentrator and you want to know if logs are passing, list the hosts that are sending logs anche check if there are the correct list of hosts with a simple search on Search Heads:

index=_internal OR index=*
| stats count BY host

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @umeshcreddy,

let me understand:

  • do you want to know if you're receiving logs from that HF
  • or do you want to know if the logs passing through the HF arrive to the Indexers?

in the first case run on Search Heads  the following search:

(index=_internal OR index=*) host=HF_hostname

 If instead your HF is a concentrator and you want to know if logs are passing, list the hosts that are sending logs anche check if there are the correct list of hosts with a simple search on Search Heads:

index=_internal OR index=*
| stats count BY host

Ciao.

Giuseppe

0 Karma

umeshcreddy
Engager

@gcusello  cant we check in the deployment sever in the forwarder management for the HF_hostname whether deployed or not.  I have this doubt can you please confirm

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @umeshcreddy,

to check if HF was deployed by Deployment Server is a different thing: it's not relevant Ds to understand if an HF is logging or not.

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...