Splunk Search

How can I see all forwarders deployed in the Distributed Management Console and in a search from internal metrics log?

brian1_tate
Path Finder

I am confused here. I work with a massive distributed environment and I want to see ALL of our thousands of forwarders in the Distributed Management Console (DMC), however the count doesn't seem to match the search I ran from the internal index and shows FAR more forwarders than the DMC. What am I missing here?

index=_internal sourcetype=splunkd destPort!="-"| stats sparkline count by hostname, sourceHost, host, destPort, version | dedup hostname | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - "Forwarder IP"
0 Karma

ddrillic
Ultra Champion

Brian,

I would base everything according to the serverclass.conf. Meaning I would correlate what the index=_internal query brings and the DMC query brings over and try to match it with serverclass.conf. Unfortunately the software doesn't do it for us at the moment.

One way to approach it would be to use a similar query for missing forwarders as in the DMC -

| inputlookup dmc_forwarder_assets
| search status="missing" 
| rename hostname as Instance

But, produce the lookup based on the serverclass.conf data.

Cheers

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi Brian,

The forwarders you see in the DMC include all current and historical forwarders - active, inactive, and missing (received data from this forwarder before but it is not currently existing any more). Please just filter the listed forwarders by status and see if ACTIVE forwarders match the number you come up with using the search command.

Hope it helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...