Getting Data In

Detect gaps in Windows Universal forwarder eventstrem

New Member


We have Splunk 6 running with Universal forarders on all our Windows servers. The forwarders are used to transfer,a subsect as configured in inputs.conf of the Windows TA, to the indexers (a cluster of 2 indexers) How can I see if there have been gaps in the data forwarderd to the indexers?

Thanks in advance!

Tags (1)
0 Karma

Ultra Champion

Take a look at MetaWoot
It will give you a high degree of confidence in which of your sources are (or are not) working!

If my comment helps, please give it a thumbs up!
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.