Getting Data In

How do we find users who installed forwarders without permission and also restrict unauthorized forwarders in the future?

New Member

In my Company we have a particulate team who works on Splunk and a few users had installed the Forwarder without us knowing. How do we find those users and, in future, how to restrict users from doing this again?

0 Karma



You can do this by going in inputs.conf on the indexer, you can either configure the splunktcp input to only accept from a specific IP address. That is not as useful, so you can also use the acceptFrom parameter to provide a list of network address ranges. See the docs for inputs.conf.

You can also use SSL and require a client certificate. If you do this, then any client must present a certificate that is signed by a specified certificate authority.


On the indexers, in the inputs.conf that specifies the listening port, set a default splunktcp stanza that lists the allowed forwarders. Example:

acceptFrom =,10.3.1.*

In the acceptFrom, you can list the allowed forwarders by IP address, DNS name, etc. You can use wildcards as well. More information in the Admin manual on inputs.conf

This will stop the incoming data from unauthorized forwarders. You can search the _internal index to see where the data has come from in the past. Here is a very simple search that lists forwarders and how much data has come from each:

index=_internal source=*metrics.log group=tcpin_connections
| eval sourceHost=coalesce(sourceHost,hostname)
| fields sourceHost kb 
| timechart sum(kb) AS kb_forwarded by sourceHost
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...