Splunk Search

How can I search for list of UF's and to which index they are sending data to ?

AK007
Engager

Hi, 

Want to find universal forwarders and to which index they are sending data to ?

We have cmd to list all the UF. Need help on how to check/co-relate internal logs to which index they are sending data to. 

Labels (4)
0 Karma

thambisetty
SplunkTrust
SplunkTrust
| tstats count  where index=_* OR index=*  by host,index
| stats values(index) as index dc(index) as distinct_count by host
| sort - distinct_count
————————————
If this helps, give a like below.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AK007,

to know the indexes where logs are stored you can run a simple search:

 

| metasearch index=*
| stats values(index) AS index count BY host

 

if you want also internal indexes:

 

| metasearch index=* OR index=_*
| stats values(index) AS index count BY host

 

In addition, if you want to check if all the UFs are sending logs, you can insert the UFs to monitor in a lookup and run a search like this:

| metasearch index=* OR index=_*
| eval host=lower(host)
| stats values(index) AS index count BY host
| append [ | inputlookup my_lookup | eval host=lower(host), count=0 | fields count host ]
| stats values(index) AS index sum(count) AS total BY host

in this way, the hosts with total=0 aren't sending logs and they are missed.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...