Finding the HeavyForwarder hosts from _internal logs

[santosh_hb]

Hi,

I have a task where I have to find all of the Heavy Forwarders that are currenly connected and sending the log data to the Splunk Indexer. I have to find all of the Heavy Forwarders hostname through the internal logs only. Could you help me with the query?

regards,
Santosh

[burwell]

We also wanted to track our heavy forwarder use and our Splunk PE advised us to use meta data.

There are two things to do.

1) On each heavy forwarder in an inputs.conf, e.g. /opt/splunk/etc/system/local/inputs.conf

[default]
host = yourhost.yourcompany.com
_meta = splunk_heavyforwarder::yourhost.yourcompany.com

Substitute yourhost.yourcompany.com with your hostname. Unfortunately each heavy forwarder will have to have its exact host name.

2) On your search heads or search head cluster in fields.conf

[splunk_heavyforwarder]
INDEXED = true

And then you can search for, or do stats with splunk_heavyforwarder (like splunk_server).

[bambarit]

Hi, can we extract by props  transforms to track HF?

[harsmarvania57 · Accepted solution]

Hi @santosh_hb,

You can use below query to find out all Enterprise Instances which are sending logs to Indexers. After that you need to filter out which one is Search Head, Cluster Master, Deployer, Deployement Server etc.

index=_internal host=<INDEXER> source=*metrics.log* group=tcpin_connections fwdType=full | dedup hostname | table _time hostname os arch version sourceIp destPort fwdType ssl

[whrg]

Hello!

Recently, I have built a dashboard to have a quick overview over all my Splunk instances. I found it difficult to filter for Heavy Forwarders because Heavy Forwarders are actually full Splunk instances like Search Heads or Deployment Servers.

Perhaps these searches will help you. Set the time range accordingly to show all active servers in that particular time range.

Here is the search for all full Splunk instances (Search Head, Heavy Forwarders...):

index=_internal sourcetype=splunkd source=*metrics.log group=tcpin_connections fwdType="full" | dedup hostname | table hostname,os,version | sort hostname

Here is the search for all Universal Forwarders:

index=_internal sourcetype=splunkd source=*metrics.log group=tcpin_connections fwdType="uf" | dedup hostname | table hostname,os,version | sort hostname

Here is the search for all Indexers:

| rest /services/server/info | search server_roles="indexer" | table splunk_server,os_name,version | sort splunk_server