Getting Data In

Figure out what forwarder data came from

Path Finder

I am trying to figure out if there is a query that will tell me which forwarder some of the data I have in my indexers came from.  This question is coming because we have a syslog server that gathers files from multiple servers, and the forwarder on the syslog server reads those syslog and sends to the indexers.  But in doing this it updates the host to be the server that is in each of the files.

What I want to know is which of our syslog servers did the actual forwarding of that data over to the indexer.

Is that data in there metadata somewhere which can be queried?


Labels (1)
0 Karma


Forwarding is transparent.  There is nothing that indicates which forwarder(s) handled a given event.

If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!