Getting Data In

Figure out what forwarder data came from

jeffbat
Path Finder

I am trying to figure out if there is a query that will tell me which forwarder some of the data I have in my indexers came from.  This question is coming because we have a syslog server that gathers files from multiple servers, and the forwarder on the syslog server reads those syslog and sends to the indexers.  But in doing this it updates the host to be the server that is in each of the files.

What I want to know is which of our syslog servers did the actual forwarding of that data over to the indexer.

Is that data in there metadata somewhere which can be queried?

Thanks.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Forwarding is transparent.  There is nothing that indicates which forwarder(s) handled a given event.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...