Splunk Search

How do I search which individual IPs are reporting into Splunk forwarders by network?

lbogle
Contributor

I am new to this particular Splunk environment and need to familiarize myself with its content and layout. The majority of logs are being parsed by syslog servers and universal forwarders, but not all reference a deployment server. What is the best search to find out what devices are currently reporting into Splunk by network? I currently have the following search.
Does this look about right?

index=_internal sourcetype=splunkd (111.111.111.* OR 222.222.222.* OR 333.333.333.*) | dedup sourceIp

I am returning entries that look like the following:

08-17-2015 12:01:23.745 -0700 INFO  StatusMgr - destPort=9998, eventType=connect_done, sourceHost=111.111.111.3, sourceIp=111.111.111.3, sourcePort=30703, statusee=TcpInputProcessor

What is this search returning for me exactly? Is there a better way for me to determine what endpoints are reporting into Splunk by subnet?
I don't have direct access to the forwarders at the moment and can't check the rlog server directories.

Thanks.

0 Karma

woodcock
Esteemed Legend

This shows you both who is phoning-home to DS and who is sending data into Indexers:

index="_internal" (sourcetype="splunkd_access" root="services" user="-" phonehome) OR ((source=*/metrics.log* OR source=*\\metrics.log*) group=tcpin_connections) | rex field=source "[/\\\](?<basename_source>[^/\\\]+)$" | stats count values(basename_source) AS sources values(host) AS hosts
0 Karma

somesoni2
SplunkTrust
SplunkTrust

This query provides which all Splunk instances are connected to Splunk Indexers (to send data) and sending heartbeat. This list the Splunk instance's Hostname/IP (sourceHost OR sourceIp) and the connecting port on Indexers (destPort). A better version of the could be like this

index=_internal sourcetype=splunkd  component=StatusMgr group=tcpin_connections | stats count by sourceHost sourceIp destPort 
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...