https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder/m-p/587120#M103151 <P>How to check inputs.conf file to see the how the log files are being sent to splunk.&nbsp;</P><P>&nbsp;</P><P>How to check forwarder is running and moved data to splunk index?&nbsp;</P> Wed, 02 Mar 2022 06:04:10 GMT kajalchopade071 2022-03-02T06:04:10Z https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder/m-p/587120#M103151 <P>How to check inputs.conf file to see the how the log files are being sent to splunk.&nbsp;</P><P>&nbsp;</P><P>How to check forwarder is running and moved data to splunk index?&nbsp;</P> Wed, 02 Mar 2022 06:04:10 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder/m-p/587120#M103151 kajalchopade071 2022-03-02T06:04:10Z https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder/m-p/587138#M103152 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/241306">@kajalchopade071</a>,</P><P>you can check if a Forwarder is running searching in _internal index, something like this:</P><LI-CODE lang="markup">index=_internal host=your_host</LI-CODE><P>if you have results, Forwarder is up and running.</P><P>To check if a Forwarder is sending a kind of logs, you have to do the same thing in the index containing the logs to check.</P><P>if you have many hosts to monitor, you have to create a lookup (called e.g. perimeter.csv), containing all the hosts to monitor (e.g. in a column called host) and run a little more comples search:</P><LI-CODE lang="markup">| metasearch index=_internal | eval host=lower(host) | stats count BY host | append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>&nbsp;Ciao.</P><P>Giuseppe</P> Wed, 02 Mar 2022 08:23:14 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder/m-p/587138#M103152 gcusello 2022-03-02T08:23:14Z