Skip to content

Instantly share code, notes, and snippets.

@yorokobi

yorokobi/gist:39dadf570689c4f9f0d1

Last active June 19, 2019 12:15
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save yorokobi/39dadf570689c4f9f0d1 to your computer and use it in GitHub Desktop.
Save yorokobi/39dadf570689c4f9f0d1 to your computer and use it in GitHub Desktop.
Download ZIP
Splunk UFs sending data to indexing tier
Raw
gistfile1.txt
index=_internal source="*metrics.lo*" group=tcpin_connections earliest=-7d latest=now
| eval sourceHost = if( isnull(hostname), sourceHost, hostname )
| dedup sourceHost
| eval connectionType=case(fwdType=="uf","Universal Forwarder", fwdType=="lwf", "Lightweight Forwarder",fwdType=="full", "Heavy Forwarder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk forwarder", connectionType=="raw" or connectionType=="rawSSL","Legacy Forwarder")
| eval build = if( isnull(build), "N/A", build )
| eval version = if( isnull(version), "pre 4.2", version )
| eval guid = if( isnull(guid), sourceHost, guid )
| eval os = if( isnull(os), "N/A", os )
| eval arch = if( isnull(arch), "N/A", arch )
| rex field=guid mode=sed "s/-//g"
| eval guid = lower(guid)
| rex field=sourceHost "(?<sourceHost>[^\.]+)\.(?<sourceDomain>.+)"
| table connectionType sourceHost sourceDomain sourceIp build version os arch guid
| outputlookup createinapp=t splunk_forwarders.csv
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment