Getting Data In

How do we find users who installed forwarders without permission and also restrict unauthorized forwarders in the future?

New Member

In my Company we have a particulate team who works on Splunk and a few users had installed the Forwarder without us knowing. How do we find those users and, in future, how to restrict users from doing this again?

0 Karma



You can do this by going in inputs.conf on the indexer, you can either configure the splunktcp input to only accept from a specific IP address. That is not as useful, so you can also use the acceptFrom parameter to provide a list of network address ranges. See the docs for inputs.conf.

You can also use SSL and require a client certificate. If you do this, then any client must present a certificate that is signed by a specified certificate authority.


On the indexers, in the inputs.conf that specifies the listening port, set a default splunktcp stanza that lists the allowed forwarders. Example:

acceptFrom =,10.3.1.*

In the acceptFrom, you can list the allowed forwarders by IP address, DNS name, etc. You can use wildcards as well. More information in the Admin manual on inputs.conf

This will stop the incoming data from unauthorized forwarders. You can search the _internal index to see where the data has come from in the past. Here is a very simple search that lists forwarders and how much data has come from each:

index=_internal source=*metrics.log group=tcpin_connections
| eval sourceHost=coalesce(sourceHost,hostname)
| fields sourceHost kb 
| timechart sum(kb) AS kb_forwarded by sourceHost
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...