Monitoring Splunk

How to know all integrated forwarders within the environment?

aasserhifni
Loves-to-Learn Everything

I see different forwarders count using the following different ways:

  1. Looking at the forwarder management at the license master
  2. Looking at the Forwarders:Deployment at the license master
  3. Looking at  dmc_forwarder_assets.csv inside /opt/splunk/etc/apps/splunk_monitoring_console/lookups/  at the license master

So, which one should I guarantee and is there any better way?

Labels (2)
0 Karma

deepakc
Builder

From the MC run the below - it should give you a starting point

index=_internal source=*metrics.log group=tcpin_connections fwdType=uf hostname=* | eval hostname=lower(hostname)  
| fields _time hostname sourceIp arch destPort fwdType os ssl version
| table _time hostname sourceIp arch destPort fwdType os ssl version
|  dedup hostname
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...