topic Re: where can i see in the splunk internal logs when a forwarder successfully started forwarding the data? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/where-can-i-see-in-the-splunk-internal-logs-when-a-forwarder/m-p/230420#M44845 <P>Tcp_connection group event will be written to _internal index, when a UF connects to an indexer. <BR /> List of Forwarders that have connected in the last 3 minutes:</P> <PRE><CODE>index=_internal group="tcpin_connections" startminutesago=3 | stats count(sourceHost) by sourceHost </CODE></PRE> Tue, 04 Oct 2016 18:11:02 GMT inventsekar 2016-10-04T18:11:02Z where can i see in the splunk internal logs when a forwarder successfully started forwarding the data? https://community.splunk.com/t5/Getting-Data-In/where-can-i-see-in-the-splunk-internal-logs-when-a-forwarder/m-p/230419#M44844 <P>Is there any specific search that i can pull out the connection established time and date?</P> Tue, 04 Oct 2016 17:56:40 GMT https://community.splunk.com/t5/Getting-Data-In/where-can-i-see-in-the-splunk-internal-logs-when-a-forwarder/m-p/230419#M44844 pavanae 2016-10-04T17:56:40Z Re: where can i see in the splunk internal logs when a forwarder successfully started forwarding the data? https://community.splunk.com/t5/Getting-Data-In/where-can-i-see-in-the-splunk-internal-logs-when-a-forwarder/m-p/230420#M44845 <P>Tcp_connection group event will be written to _internal index, when a UF connects to an indexer. <BR /> List of Forwarders that have connected in the last 3 minutes:</P> <PRE><CODE>index=_internal group="tcpin_connections" startminutesago=3 | stats count(sourceHost) by sourceHost </CODE></PRE> Tue, 04 Oct 2016 18:11:02 GMT https://community.splunk.com/t5/Getting-Data-In/where-can-i-see-in-the-splunk-internal-logs-when-a-forwarder/m-p/230420#M44845 inventsekar 2016-10-04T18:11:02Z