Hosts sending logs to an UF

[wvalente]

Dears,

I have one UF that is receiving logs from many servers. This UF forward logs to my indexer.

How can I see which devices are being sent from this UF?

I tried the following search:

index=_internal host=myforwarder group=tcpin_connections | stats sum(kb) by sourceIp

Is there any other way?

Thanks a lot.

[renjith_nair]

Is it a UF or HF? Because UF sends the logs to an HF and HF then forwards to indexer. Nevertheless, if you want to list only the UFs, then index="_internal" source="*metrics.log*" group=tcpin_connections fwdType=uf should work