I am trying to figure out if there is a query that will tell me which forwarder some of the data I have in my indexers came from. This question is coming because we have a syslog server that gathers files from multiple servers, and the forwarder on the syslog server reads those syslog and sends to the indexers. But in doing this it updates the host to be the server that is in each of the files.
What I want to know is which of our syslog servers did the actual forwarding of that data over to the indexer.
Is that data in there metadata somewhere which can be queried?
Thanks.
