Universal Forwarder Throughput Limit Hit Count

This search counts the amount of times the UF’s throughput limit is hit. I also threw in a sparkline:

Continue Reading →

Traffic Volume by Forwarder

This Splunk search query will show you the top 10 “chattiest” forwarders on your network. I’ve used this query to determine why some forwarders were sending more data than others. The results are displayed in kilobits, you could use an eval to change it to the appropriate size for your network.

Continue Reading →

List Ports Forwarders are Using

Use the following Splunk Search Query to list what ports your Universal Forwarders are using to communicate to the Indexer:

Continue Reading →