topic Figure out what forwarder data came from in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Figure-out-what-forwarder-data-came-from/m-p/531739#M89439 <P>I am trying to figure out if there is a query that will tell me which forwarder some of the data I have in my indexers came from.&nbsp; This question is coming because we have a syslog server that gathers files from multiple servers, and the forwarder on the syslog server reads those syslog and sends to the indexers.&nbsp; But in doing this it updates the host to be the server that is in each of the files.</P><P>What I want to know is which of our syslog servers did the actual forwarding of that data over to the indexer.</P><P>Is that data in there metadata somewhere which can be queried?</P><P>Thanks.</P> Wed, 02 Dec 2020 16:38:05 GMT jeffbat 2020-12-02T16:38:05Z Figure out what forwarder data came from https://community.splunk.com/t5/Getting-Data-In/Figure-out-what-forwarder-data-came-from/m-p/531739#M89439 <P>I am trying to figure out if there is a query that will tell me which forwarder some of the data I have in my indexers came from.&nbsp; This question is coming because we have a syslog server that gathers files from multiple servers, and the forwarder on the syslog server reads those syslog and sends to the indexers.&nbsp; But in doing this it updates the host to be the server that is in each of the files.</P><P>What I want to know is which of our syslog servers did the actual forwarding of that data over to the indexer.</P><P>Is that data in there metadata somewhere which can be queried?</P><P>Thanks.</P> Wed, 02 Dec 2020 16:38:05 GMT https://community.splunk.com/t5/Getting-Data-In/Figure-out-what-forwarder-data-came-from/m-p/531739#M89439 jeffbat 2020-12-02T16:38:05Z Re: Figure out what forwarder data came from https://community.splunk.com/t5/Getting-Data-In/Figure-out-what-forwarder-data-came-from/m-p/531743#M89442 <P>Forwarding is transparent.&nbsp; There is nothing that indicates which forwarder(s) handled a given event.</P> Wed, 02 Dec 2020 16:56:30 GMT https://community.splunk.com/t5/Getting-Data-In/Figure-out-what-forwarder-data-came-from/m-p/531743#M89442 richgalloway 2020-12-02T16:56:30Z