Splunk Search

How to determine which forwarder sent data without relying on host?

jeff
Contributor

I have a pool of identically configured rsyslog servers behind a load balancer. Each hosts' data is written to a log file in a host-specific directory (/var/log/rsyslog/[date]/[host]/message.log). Splunk Universal Forwarder is configured on each rsyslog server to read log data, setting host based on the directory name (host_segment).

When the data reaches the Splunk indexer, the host is properly configured to the source of the log data, and the splunk_server is set to the indexer. Is there something that will tell me which of the rsyslog servers actually sent the data? If it's there I'm not finding it.

Tags (3)
0 Karma

Takajian
Builder

I do not think each events contain the information where the event come from. But following internal log contains which forwarder send data.

/opt/splunk/var/log/metrics.log

If this does not help, please let me know more detail what you are looking for.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...