Splunk Enterprise

Understand which hosts sends logs to which Splunk Component


Hi Splunkers, today I have a problem about understanding how and where Log Sources sends logs to Splunk.
In this particular Splunk On Prem environments, no documentation has been done, except the HLD.
So, we have to understand, for each log source, what Splunk component it reaches and how.
For example, if I have a Domain Controller, we must establish:

  • Where it sends logs? Directly to Indexers? To a HF?
  • A UF is installed on it? If not, how it send logs? WMI? WEF? Other

And so on.

Now, List of servers sending logs to Heavy forwarder is a community discussion where I started from @scelikok suggested search, changed it in:



index=_internal component=TcpOutputProc 
| stats count values(host) as host by idx 
| fields - count



and it helped me a lot: I'm able, for each Splunk Component of env (IDS, HF and so on) to understand what Log sources send them data.

So, what's the problem? The above search return data forwarded by another Splunk component.
I mean, in the output, field idx has always format ip/hostname:9997, so it means that data are coming from a server with UF or from another Splunk host (we have some intermediate forwarder, so sometimes I can see data ingested by an HF coming from another HF). What about data sent not with a Splunk agent/host?
For example, suppose I have this flow:

Log source with Syslog -> Splunk HF receive on port 514

With above search, I cannot see those sources (and I know for sure they exist on our env).
How can I recover it? The syslog is only an example, the key point here is: I must complete my search with all log sources that do not use UF and/or any other Splunk element, but other forwarding tool/protocol (syslog, API, WEF, and so on).

0 Karma
1 Solution


Hi @SplunkExplorer 

> Where it sends logs? Directly to Indexers? To a HF?

A Splunk UF generally will send the logs to indexer. but if your indexer is overloaded and if you want to do some preprocessing beforehand, then you should use a HF(from UF, send the logs to HF.. HF will do some parsing tasks, then it will send the logs to indexer)

> A UF is installed on it? If not, how it send logs? WMI? WEF? Other

yes, WMI options is available. and if you can not install the UF, then you can use a syslog server to collect the logs from all systems that dont have UF and send it to a HF or indexer.. 

0 Karma

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...