Splunk Cloud: How to track sources on Splunk Cloud searchead coming from different intermediate forwarder?

[singhdb]

Platform: Splunk Cloud

Problem statement illustration:

we have 4 intermediate forwarders, and more than 2500 universal forwarders are routing data to these four IFWs.

UF (700)----> IFW1------>Splunk cloud

UF (600)----> IFW2------>Splunk cloud

UF (700)----> IFW3------>Splunk cloud

UF (500)----> IFW4------>Splunk cloud

What is needed: How a splunk admin/power user can create a dashboard or fetch information from searchead that which are all sources being routed to splunk cloud through each IFW

query should list the universal forwarder hostname and respective ifw from where it getting routed to splunk cloud

Any lead on this

[richgalloway]

By default, intermediate forwarders (IFs) are invisible.  There is nothing that says which IF an event passed through (or even *if* an IF was involved at all).

To work around that, you will have to add configs to your IFs to have them add a field to every event.  That field would identify which IF processed the event.  One way to do it is to add _meta = forwarder::foo to the IF's inputs.conf file.  This line assigns the value "foo" to the field "forwarder".  You can change "forwarder" to any field you wish.  Of course, you must change "foo" to the actual name of the forwarder.