How can I see all forwarders deployed in the Distributed Management Console and in a search from internal metrics log?

[brian1_tate]

I am confused here. I work with a massive distributed environment and I want to see ALL of our thousands of forwarders in the Distributed Management Console (DMC), however the count doesn't seem to match the search I ran from the internal index and shows FAR more forwarders than the DMC. What am I missing here?

index=_internal sourcetype=splunkd destPort!="-"| stats sparkline count by hostname, sourceHost, host, destPort, version | dedup hostname | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - "Forwarder IP"

[ddrillic]

Brian,

I would base everything according to the serverclass.conf. Meaning I would correlate what the index=_internal query brings and the DMC query brings over and try to match it with serverclass.conf. Unfortunately the software doesn't do it for us at the moment.

One way to approach it would be to use a similar query for missing forwarders as in the DMC -

| inputlookup dmc_forwarder_assets
| search status="missing" 
| rename hostname as Instance

But, produce the lookup based on the serverclass.conf data.

Cheers

[hunters_splunk]

Hi Brian,

The forwarders you see in the DMC include all current and historical forwarders - active, inactive, and missing (received data from this forwarder before but it is not currently existing any more). Please just filter the listed forwarders by status and see if ACTIVE forwarders match the number you come up with using the search command.

Hope it helps. Thanks!
Hunter