Splunk Enterprise

Splunk Universal Forwarder Phone Home Via Intermediate Forwarder

JselbyELC
New Member

Hi All,

I'm currently using a query on a dashboard that is showing Splunk Machines that are online,
index="_internal" services/broker/phonehome/connection | stats count by host (for the past 15 minutes)

My problem is half of my machines sit behind a firewall and send their data via an intermediate forwarder.

Diagram Bellow (Security Team wouldn't sign off the solution unless i followed this approach)

alt text

I cannot show the status of these endpoints using the same method as the host value for data in the internal index has the forwarder's hostname rather than the actual endpoint.

Has anyone found a way around this?

Thanks

Josh

Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

Try this:

index="_internal" services/broker/phonehome/connection 
| rex field=uri "8089_(?P<client>.+?)_" | stats count by client

It will give you a DNS name when it has one, or failing that an IP if it cant be resolved.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

woodcock
Esteemed Legend

You should not "make it work" the way that it is. You should correct your forwarding so that the intermediate forwarder is NOT listead as host. This is not difficult and there are many articles and approaches on how to do host override.

0 Karma

nickhills
Ultra Champion

Try this:

index="_internal" services/broker/phonehome/connection 
| rex field=uri "8089_(?P<client>.+?)_" | stats count by client

It will give you a DNS name when it has one, or failing that an IP if it cant be resolved.

If my comment helps, please give it a thumbs up!
0 Karma

JselbyELC
New Member

Thank you for your help the query was very helpful, i managed to fix my Hostname problem after restarting the splunk server a couple of times!

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...