Splunk Universal Forwarder Phone Home Via Intermediate Forwarder

[JselbyELC]

Hi All,

I'm currently using a query on a dashboard that is showing Splunk Machines that are online,
index="_internal" services/broker/phonehome/connection | stats count by host (for the past 15 minutes)

My problem is half of my machines sit behind a firewall and send their data via an intermediate forwarder.

Diagram Bellow (Security Team wouldn't sign off the solution unless i followed this approach)

I cannot show the status of these endpoints using the same method as the host value for data in the internal index has the forwarder's hostname rather than the actual endpoint.

Has anyone found a way around this?

Thanks

Josh

[woodcock]

You should not "make it work" the way that it is. You should correct your forwarding so that the intermediate forwarder is NOT listead as host. This is not difficult and there are many articles and approaches on how to do host override.

[nickhills · Accepted solution]

Try this:

index="_internal" services/broker/phonehome/connection 
| rex field=uri "8089_(?P<client>.+?)_" | stats count by client

It will give you a DNS name when it has one, or failing that an IP if it cant be resolved.

[JselbyELC]

Thank you for your help the query was very helpful, i managed to fix my Hostname problem after restarting the splunk server a couple of times!