SPL
List Ports Forwarders are Using
1 0
Description
Use the following Splunk Search Query to list what ports your Universal Forwarders are using to communicate to the Indexer:
index="_internal" source="*metrics.lo*" group=tcpin_connections NOT eventType=* | dedup sourceHost |stats count by destPort
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.