how can check all the host detail forwarder to splunk indexer please share the qurey?

[satkan100]

how can check all the host detail forwarder to splunk indexer please share the qurey?

[p_gurav · Accepted solution]

Hi,

Can you try below query:

index=_internal sourcetype=splunkd destPort!="-"| stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Universal Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Universal Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - count