Splunk Enterprise

Splunk Universal Forwarder Phone Home Via Intermediate Forwarder

JselbyELC
New Member

Hi All,

I'm currently using a query on a dashboard that is showing Splunk Machines that are online,
index="_internal" services/broker/phonehome/connection | stats count by host (for the past 15 minutes)

My problem is half of my machines sit behind a firewall and send their data via an intermediate forwarder.

Diagram Bellow (Security Team wouldn't sign off the solution unless i followed this approach)

alt text

I cannot show the status of these endpoints using the same method as the host value for data in the internal index has the forwarder's hostname rather than the actual endpoint.

Has anyone found a way around this?

Thanks

Josh

Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

Try this:

index="_internal" services/broker/phonehome/connection 
| rex field=uri "8089_(?P<client>.+?)_" | stats count by client

It will give you a DNS name when it has one, or failing that an IP if it cant be resolved.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

woodcock
Esteemed Legend

You should not "make it work" the way that it is. You should correct your forwarding so that the intermediate forwarder is NOT listead as host. This is not difficult and there are many articles and approaches on how to do host override.

0 Karma

nickhills
Ultra Champion

Try this:

index="_internal" services/broker/phonehome/connection 
| rex field=uri "8089_(?P<client>.+?)_" | stats count by client

It will give you a DNS name when it has one, or failing that an IP if it cant be resolved.

If my comment helps, please give it a thumbs up!
0 Karma

JselbyELC
New Member

Thank you for your help the query was very helpful, i managed to fix my Hostname problem after restarting the splunk server a couple of times!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...