https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-path-for-an-unknown-data-source-that-is-sending/m-p/216718#M42646 <P>I'd check a few things:</P> <UL> <LI>timestamps on the events - maybe they're old and you're chasing ghosts?</LI> <LI>host and source of the events</LI> <LI>receiving enabled on the indexer</LI> <LI>search <CODE>index=_internal source=*metrics.log* group=tcpin_connections</CODE> for info around incoming forwarder connections</LI> <LI>inputs enabled on the indexer</LI> <LI>if source and inputs don't line up, check for props.conf/transforms.conf rewrites (<CODE>TRANSFORMS-foo</CODE> in props.conf)</LI> <LI>search <CODE>index=_internal source=*metrics.log* thruput</CODE> for clues where the indexer thinks it has throughput</LI> </UL> Tue, 23 Feb 2016 17:49:44 GMT martin_mueller 2016-02-23T17:49:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-path-for-an-unknown-data-source-that-is-sending/m-p/216717#M42645 <P>How can I tell where data is coming from? I have inherited an old Splunk 5.0.1 Enterprise Infrastructure. I can see data on the Splunk head for a specific (IP) server, however, this data is coming into _main. I got on the Windows box where this data is coming from and I could not see a universal forwarder or syslog implementation despite much searching. I do not know how the data is coming into Splunk, which is a problem since I need the data to go into a different index. This leaves me asking, how is the data coming in? Is there a way to trace events all the way back to the origination point AND know what the path that the data took? I there a way to know what process originated the data on the machine?</P> Tue, 23 Feb 2016 17:31:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-path-for-an-unknown-data-source-that-is-sending/m-p/216717#M42645 darknetone 2016-02-23T17:31:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-path-for-an-unknown-data-source-that-is-sending/m-p/216718#M42646 <P>I'd check a few things:</P> <UL> <LI>timestamps on the events - maybe they're old and you're chasing ghosts?</LI> <LI>host and source of the events</LI> <LI>receiving enabled on the indexer</LI> <LI>search <CODE>index=_internal source=*metrics.log* group=tcpin_connections</CODE> for info around incoming forwarder connections</LI> <LI>inputs enabled on the indexer</LI> <LI>if source and inputs don't line up, check for props.conf/transforms.conf rewrites (<CODE>TRANSFORMS-foo</CODE> in props.conf)</LI> <LI>search <CODE>index=_internal source=*metrics.log* thruput</CODE> for clues where the indexer thinks it has throughput</LI> </UL> Tue, 23 Feb 2016 17:49:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-path-for-an-unknown-data-source-that-is-sending/m-p/216718#M42646 martin_mueller 2016-02-23T17:49:44Z