search to show me all my splunk enterprise devices

[net1993]

Hi
Is there a search in splunk which I can run from search head which will show me all splunk enterprise devices?

[skalliger]

If you're referring to Splunk Enterprise instances as well as Forwarders, you might want to take a look into the Monitoring Console as it offers all of that. If you want those dashbaords combined, just steal that SPL and put it in your own dashboard as many of those searches are simply searching through the _internal index of Splunk.

Skalli

[MuS · Accepted solution]

Hi net1993,

if all of your Splunk Enterprise instances are configured using best practices then they forward their _internal logs to your indexer. This means you can search the index=_internal for these instances like this:

index=_internal sourcetype=splunkd fwdType=full

Hope this helps ...

cheers, MuS

[skalliger]

Oh, I was too slow 😞

[gcusello]

Hi @net1993,
what do you mean with "splunk enterprise devices"?
if you mean Splunk Enterprise components (Search Heads, Indexers, Heavy Forwarders Universal Forwarders, and the other roles, you can configure and use Monitor Console [Settings -- Monitor Console].

You can also have an idea with a simple search index=_internal | stats count BY host because in this way you have the internal logs of all Splunk components, but you cannot separate Universal Forwarders from the others.

Ciao.
Giuseppe