https://community.splunk.com/t5/Getting-Data-In/confirm-if-heavy-forwarder-is-receiving-any-data/m-p/297870#M56372 <P>Assuming that your HV is linux-based (it had better be, for your own benefit), you can just do a packet capture like this:</P> <PRE><CODE>tcpdump -n host YOUR.FORWARDER.IP.HERE </CODE></PRE> Wed, 17 May 2017 11:36:08 GMT woodcock 2017-05-17T11:36:08Z https://community.splunk.com/t5/Getting-Data-In/confirm-if-heavy-forwarder-is-receiving-any-data/m-p/297869#M56371 <P>We have 6.5 Splunk instance configured as a heavy forwarder.</P> <P>We are forwarding data from Cloud PAAS service and that is reason logs which are forwarded are from an API so we dont have any IP to check if connectivity is possible but the team governing the PAAS tool is suggesting it has already configured to forward the data to Splunk.</P> <P>Now, in the Heavy forwarder which we configured how can we confirm if it is reachable to the PAAS tool or it is getting any data from the tool.</P> <P>THanks.<BR /> Vikram.</P> Wed, 17 May 2017 09:44:20 GMT https://community.splunk.com/t5/Getting-Data-In/confirm-if-heavy-forwarder-is-receiving-any-data/m-p/297869#M56371 vikram_m 2017-05-17T09:44:20Z https://community.splunk.com/t5/Getting-Data-In/confirm-if-heavy-forwarder-is-receiving-any-data/m-p/297870#M56372 <P>Assuming that your HV is linux-based (it had better be, for your own benefit), you can just do a packet capture like this:</P> <PRE><CODE>tcpdump -n host YOUR.FORWARDER.IP.HERE </CODE></PRE> Wed, 17 May 2017 11:36:08 GMT https://community.splunk.com/t5/Getting-Data-In/confirm-if-heavy-forwarder-is-receiving-any-data/m-p/297870#M56372 woodcock 2017-05-17T11:36:08Z