Splunk Enterprise

How do I take an inventory of all my hosts, indexers, forwarders at a Med size company

SamHTexas
Builder

Hello team, In order to take an inventory of my Indexers, Forwarders, & host to get started what do I need to do. 1. What would be some SPL scripts would I need to use? 

2. Should I be doing this off the hours or middle of the day is fine as well?

Thank u

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The Monitoring Console will know what your indexers are and can be set up to also monitor your forwarders.

How to inventory hosts depends on what you mean by "host".  If it just means those computers that are sending data to Splunk then you can do it using SPL.

| tstats count where index=* host=* by host
| fields - count

It you need an inventory of all computers in your company then someone from the networking team may be able to help by providing a list of every machine that has connected to the network.  Failing that, someone may have to walk the floor(s) looking for computers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Monitoring Console will know what your indexers are and can be set up to also monitor your forwarders.

How to inventory hosts depends on what you mean by "host".  If it just means those computers that are sending data to Splunk then you can do it using SPL.

| tstats count where index=* host=* by host
| fields - count

It you need an inventory of all computers in your company then someone from the networking team may be able to help by providing a list of every machine that has connected to the network.  Failing that, someone may have to walk the floor(s) looking for computers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

SamHTexas
Builder

I thank you buddy. I have another couple of questions please - it would really help me.

Please share how to get a complete list of Forwarders in an environment (spl)

I have tried a few scripts that I know but not working. What search script would I use to get a list of forwarders & indexers that are having trouble or need updates?

Thank u bro. You are a big help & thank u. Stay safe & healthy, have a nice weekend too.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...