Splunk Search

search to show me all my splunk enterprise devices

net1993
Path Finder

Hi
Is there a search in splunk which I can run from search head which will show me all splunk enterprise devices?

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi net1993,

if all of your Splunk Enterprise instances are configured using best practices then they forward their _internal logs to your indexer. This means you can search the index=_internal for these instances like this:

index=_internal sourcetype=splunkd fwdType=full

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

skalliger
SplunkTrust
SplunkTrust

If you're referring to Splunk Enterprise instances as well as Forwarders, you might want to take a look into the Monitoring Console as it offers all of that. If you want those dashbaords combined, just steal that SPL and put it in your own dashboard as many of those searches are simply searching through the _internal index of Splunk.

Skalli

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi net1993,

if all of your Splunk Enterprise instances are configured using best practices then they forward their _internal logs to your indexer. This means you can search the index=_internal for these instances like this:

index=_internal sourcetype=splunkd fwdType=full

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

skalliger
SplunkTrust
SplunkTrust

Oh, I was too slow 😞

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @net1993,
what do you mean with "splunk enterprise devices"?
if you mean Splunk Enterprise components (Search Heads, Indexers, Heavy Forwarders Universal Forwarders, and the other roles, you can configure and use Monitor Console [Settings -- Monitor Console].

You can also have an idea with a simple search index=_internal | stats count BY host because in this way you have the internal logs of all Splunk components, but you cannot separate Universal Forwarders from the others.

Ciao.
Giuseppe

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!