Is there a way to report on the devices depositing syslogs on my heavy forwarders?

[mflippin]

I need to write a search to report on what devices are sending logs to my heavy forwarders using syslog-ng to the /var/log/splunk/* directory. The issue is those directories under Splunk are mostly by IP address instead of host name.

I'd like to map the source log location to the index or vendor type which I could then use to determine if every device log type is actually being ingested into Splunk.

I tried Index!=_* | chart count by sourcetype, host limit=100 but it doesn't identify the folder the log is in.

Any ideas would be helpful.

[somesoni2]

Try something like this

| tstats count WHERE index=* by index, source  | search source="/var/log/splunk/*"

THis should give mapping of all index and corresponding source from location /var/log/splunk/ .