https://community.splunk.com/t5/Getting-Data-In/How-to-identify-in-the-splunkd-log-when-Splunk-is-no-longer/m-p/151246#M30775 <P>Yes this command will show me the inputs that Splunk is currently monitoring. It does not indicate if one of these monitored inputs is no longer being indexed for any given reason.</P> Mon, 06 Oct 2014 08:19:25 GMT Ant1D 2014-10-06T08:19:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-identify-in-the-splunkd-log-when-Splunk-is-no-longer/m-p/151244#M30773 <P>Hey,</P> <P>Is there an event in splunkd.log which identifies when a stanza defined in inputs.conf which is not disabled is no longer being indexed?</P> <P>Thanks in advance for your help</P> Fri, 03 Oct 2014 16:32:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-identify-in-the-splunkd-log-when-Splunk-is-no-longer/m-p/151244#M30773 Ant1D 2014-10-03T16:32:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-identify-in-the-splunkd-log-when-Splunk-is-no-longer/m-p/151245#M30774 <P>You can check the same by running ./splunk list monitor command on the forwarder</P> Fri, 03 Oct 2014 17:10:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-identify-in-the-splunkd-log-when-Splunk-is-no-longer/m-p/151245#M30774 pradeepkumarg 2014-10-03T17:10:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-identify-in-the-splunkd-log-when-Splunk-is-no-longer/m-p/151246#M30775 <P>Yes this command will show me the inputs that Splunk is currently monitoring. It does not indicate if one of these monitored inputs is no longer being indexed for any given reason.</P> Mon, 06 Oct 2014 08:19:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-identify-in-the-splunkd-log-when-Splunk-is-no-longer/m-p/151246#M30775 Ant1D 2014-10-06T08:19:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-identify-in-the-splunkd-log-when-Splunk-is-no-longer/m-p/151247#M30776 <P>Hello Ant1D,<BR /> Rather than going for splunkd.log you can search in splunk metadata command. You wont be finding any indication in the splunkd.log if is has been stopped for monitoring because splunk will keep on monitoring but doesn't actually read anything unless it has changed state.</P> <PRE><CODE>|metadata type=sources index=Index_Name|where source like '%part_of_Source%' </CODE></PRE> <P>Of course you wont be able to find if there are many hosts having the same source names. </P> <P>Thanks,<BR /> L</P> Mon, 06 Oct 2014 09:12:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-identify-in-the-splunkd-log-when-Splunk-is-no-longer/m-p/151247#M30776 linu1988 2014-10-06T09:12:48Z