How do I search which individual IPs are reporting into Splunk forwarders by network?

[lbogle]

I am new to this particular Splunk environment and need to familiarize myself with its content and layout. The majority of logs are being parsed by syslog servers and universal forwarders, but not all reference a deployment server. What is the best search to find out what devices are currently reporting into Splunk by network? I currently have the following search.
Does this look about right?

index=_internal sourcetype=splunkd (111.111.111.* OR 222.222.222.* OR 333.333.333.*) | dedup sourceIp

I am returning entries that look like the following:

08-17-2015 12:01:23.745 -0700 INFO  StatusMgr - destPort=9998, eventType=connect_done, sourceHost=111.111.111.3, sourceIp=111.111.111.3, sourcePort=30703, statusee=TcpInputProcessor

What is this search returning for me exactly? Is there a better way for me to determine what endpoints are reporting into Splunk by subnet?
I don't have direct access to the forwarders at the moment and can't check the rlog server directories.

Thanks.

[woodcock]

This shows you both who is phoning-home to DS and who is sending data into Indexers:

index="_internal" (sourcetype="splunkd_access" root="services" user="-" phonehome) OR ((source=*/metrics.log* OR source=*\\metrics.log*) group=tcpin_connections) | rex field=source "[/\\\](?<basename_source>[^/\\\]+)$" | stats count values(basename_source) AS sources values(host) AS hosts

[somesoni2]

This query provides which all Splunk instances are connected to Splunk Indexers (to send data) and sending heartbeat. This list the Splunk instance's Hostname/IP (sourceHost OR sourceIp) and the connecting port on Indexers (destPort). A better version of the could be like this

index=_internal sourcetype=splunkd  component=StatusMgr group=tcpin_connections | stats count by sourceHost sourceIp destPort