https://community.splunk.com/t5/Getting-Data-In/Where-is-my-host-data-coming-from/m-p/64958#M13058 <P>OK, I found it by looking through the splunkd.log file. </P> <P>I looked for the host in question, and looked for the connections around the containing entry. That led me to the inputs.conf file that had the mistake. </P> <P>Hope this helps someone else in the distant future. </P> <UL> <LI>Sean </LI> </UL> Wed, 23 Mar 2011 03:26:16 GMT seanlon11 2011-03-23T03:26:16Z https://community.splunk.com/t5/Getting-Data-In/Where-is-my-host-data-coming-from/m-p/64957#M13057 <P>I have about 50 forwarders in my environment. Somewhere I have screwed up, and included the same set of host data twice, but one with a typo. I went to the inputs.conf and looked at the stanza, and I only have the correctly spelled host. So somewhere I have messed something up. </P> <P>How can I tell where a particular host's data is coming from? (preferrably the IP address)</P> <P>Thanks, Sean </P> Tue, 22 Mar 2011 23:04:29 GMT https://community.splunk.com/t5/Getting-Data-In/Where-is-my-host-data-coming-from/m-p/64957#M13057 seanlon11 2011-03-22T23:04:29Z https://community.splunk.com/t5/Getting-Data-In/Where-is-my-host-data-coming-from/m-p/64958#M13058 <P>OK, I found it by looking through the splunkd.log file. </P> <P>I looked for the host in question, and looked for the connections around the containing entry. That led me to the inputs.conf file that had the mistake. </P> <P>Hope this helps someone else in the distant future. </P> <UL> <LI>Sean </LI> </UL> Wed, 23 Mar 2011 03:26:16 GMT https://community.splunk.com/t5/Getting-Data-In/Where-is-my-host-data-coming-from/m-p/64958#M13058 seanlon11 2011-03-23T03:26:16Z