Getting Data In

What does this Forwarder Management pop up mean?

domino30
Explorer

forwarder management.PNG

 When I see this screen I think ... this is where all my forwarder  are any that I've added no matter the means will show up here and I can see their status.

How wrong am I?

 

also technically could you have lets say 2 forwarder but 20 machines sending data to those forwarder  and then those forwarders sending data to your indexers where you can then  uses app or searches to make sense of that data?

Labels (1)
0 Karma
1 Solution

chaker
Contributor

1: If you want your forwarders to show up there, you need to run the following command:

https://docs.splunk.com/Documentation/Splunk/9.0.0/Updating/Configuredeploymentclients

splunk set deploy-poll <IP_address/hostname>:<management_port>
splunk restart

This will update a file called deploymentclient.conf on your universal forwarders. In a production environment, you would deploy that file in an app or have the app already packaged with the OS image, but the above command will still work.

2:  If you have 2 forwarders, each receiving data feeds from other hosts/devices, you will need to use Splunk metadata field "host".  This can be done by either manually setting a value per input, or having a value extracted from a filename or filepath. 

It is possible to set the host name based on the content of the event, but you will need to do this on your indexer or heavy forwarder, and universal forwarder will not work.

https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Overridedefaulthostassignments

 

View solution in original post

gcusello
Esteemed Legend

Hi @domino30,

in addition to the correct answer of @chaker, I add that you can use the Monitoring Console to see all the Forwarders that are sending data to your Splunk infrastructure.

The screenshot you shared displays the managed Forwarders, not the sending data Forwarders, in your case, if you have two intermediate Forwarders and twenty final Forwarders, you'll seein this dashboard only the two intermediate Forwarders and in Monitoring console all the 22 Forwarders.

As I said, to have the list of sending data forwarders, you have to use the Monitoring Console or run a search like this:

| metasearch index=_internal
| stats count BY host

Ciao.

Giuseppe

chaker
Contributor

1: If you want your forwarders to show up there, you need to run the following command:

https://docs.splunk.com/Documentation/Splunk/9.0.0/Updating/Configuredeploymentclients

splunk set deploy-poll <IP_address/hostname>:<management_port>
splunk restart

This will update a file called deploymentclient.conf on your universal forwarders. In a production environment, you would deploy that file in an app or have the app already packaged with the OS image, but the above command will still work.

2:  If you have 2 forwarders, each receiving data feeds from other hosts/devices, you will need to use Splunk metadata field "host".  This can be done by either manually setting a value per input, or having a value extracted from a filename or filepath. 

It is possible to set the host name based on the content of the event, but you will need to do this on your indexer or heavy forwarder, and universal forwarder will not work.

https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Overridedefaulthostassignments

 

Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...