Security

How do you build a search that gets a list of forwarders using SSL with successful connections?

guheal
New Member

Can you help me make a search/query so I can get a list of forwarders using SSL with successful connections?

Tags (2)
0 Karma

zrxcrasher
Loves-to-Learn Lots

I am working on the following which gives a more complete picture. Downloading to XLS and then turning on filtering allows you to easily see OS type, ForwarderType, Version, lastIndexer communicated with, etc.

index=_internal source=*metrics.log component=Metrics group=tcpin_connections
| dedup hostname
| table hostname, sourceIp, os, arch, fwdType, version, ssl, guid, lastIndexer, _time
| sort hostname

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @guheal,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

inventsekar
SplunkTrust
SplunkTrust

This works fine on my Splunk 7.0.3
index=_internal source=*metrics.log group=tcpin_connections ssl=true

To have the forwarder and the connect time as a table -
index=_internal source=*metrics.log group=tcpin_connections ssl=true | table sourceHost _time

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...