https://community.splunk.com/t5/Getting-Data-In/Is-there-some-way-to-see-the-current-tailing-status/m-p/11116#M516 <P>This is a great question, if only it had an answer. Oh wait?</P> Thu, 08 Apr 2010 07:24:20 GMT jrodman 2010-04-08T07:24:20Z https://community.splunk.com/t5/Getting-Data-In/Is-there-some-way-to-see-the-current-tailing-status/m-p/11115#M515 <P>Is there a splunk command or REST endpoint to see the tailing status of monitored files?</P> Thu, 08 Apr 2010 06:40:03 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-some-way-to-see-the-current-tailing-status/m-p/11115#M515 the_wolverine 2010-04-08T06:40:03Z https://community.splunk.com/t5/Getting-Data-In/Is-there-some-way-to-see-the-current-tailing-status/m-p/11116#M516 <P>This is a great question, if only it had an answer. Oh wait?</P> Thu, 08 Apr 2010 07:24:20 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-some-way-to-see-the-current-tailing-status/m-p/11116#M516 jrodman 2010-04-08T07:24:20Z https://community.splunk.com/t5/Getting-Data-In/Is-there-some-way-to-see-the-current-tailing-status/m-p/11117#M517 <P>Try hitting this url:</P> <PRE><CODE><A href="https://yoursplunkhost:8089/services/admin/inputstatus/TailingProcessor%3AFileStatus" target="test_blank">https://yoursplunkhost:8089/services/admin/inputstatus/TailingProcessor%3AFileStatus</A> </CODE></PRE> <UL> <LI>replace <STRONG>yoursplunkhost</STRONG> with your splunk server name</LI> <LI>replace <STRONG>8089</STRONG> with your configured mgmt port number. </LI> </UL> <P>This only works if you changed the admin password on the Splunk instance/universal forwarder.</P> <P>Otherwise you can run this command on the host:</P> <PRE><CODE>./splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus </CODE></PRE> Thu, 08 Apr 2010 09:36:56 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-some-way-to-see-the-current-tailing-status/m-p/11117#M517 the_wolverine 2010-04-08T09:36:56Z