List of universal Forwarder

[rahul2gupta]

Hi,

Is there any method to get the list of all the universal forwarder that is being forwarded to Indexer?

Regards,

Rahul

[gcusello]

Hi @rahul2gupta,

you can run a simple search like this:

index=_internal
| stats count BY host

Buy it's easier to see in the Monitoring Console at [Settings -- Monitoring Console -- Forwarders -- Forwarders: Deployment].

Ciao.

Giuseppe

[PickleRick]

Also - I can imagine a situation (it would be very uncommon though but it's possible) that someone disables monitoring local forwarder log files and forwarding them to indexers. That way you'd be left without entries in _internal index regarding this particular forwarder.

But yes, that's very unprobable.

[gcusello]

Hi at all,

using the _internal logs you're sure that the forwarder is working and this is the first step in monitoring.

Then if someone modified the local configurations is a different thing, if you use a Deployment Server it continuously checks the local configurations and updates them if wrong.

Ciao.

Giuseppe