Splunk Search

Is there a way to search which heavy forwarder sent a log to the indexer?

galwood
New Member

Is there a way to search a log and figure out which heavy forwarder sent the log to the indexer?

0 Karma

jlanders
Path Finder

Had a need for this today. This search does the trick for me:

index=_internal (host=myheavyforwarder1 OR host=myheavyforwarder2 OR host=myheavyforwarder3) sourcetype=splunkd "group=tcpin_connections" component=Metrics | timechart span=30m dc(hostname) by host

From this, I can see the distinct count of hostnames flowing through each heavy forwarder...

jlanders
Path Finder

Btw, if you were to dig into these metrics, you could infer other things... like which logs went through which heavy forwarder by looking at group=per_source_thruput series="your source". The key is "infer" because your universal forwarders should load balance through your heavy forwarders and most logs will go through all of them.

With the combination of the per source thruput and a rough timeframe though, you could take a good guess.

0 Karma

somesoni2
Revered Legend

I would say it depends on how you've setup log monitoring.

a)If you're not overriding the host, the host field in your log will denote the forwarder which is collected it.

your base search | stats count by host | table host

b) If you're overriding the host, then find the host (overridden) value in your logs and search for corresponding logging server in metrics logs

index=_internal sourcetype=splunkd source=*metrics.log group=per-host_thruput series="hostValueFromYourLog" | stats count by host | table host
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...