Getting Data In

How to identify in the splunkd.log when Splunk is no longer monitoring a data input?



Is there an event in splunkd.log which identifies when a stanza defined in inputs.conf which is not disabled is no longer being indexed?

Thanks in advance for your help

0 Karma


Hello Ant1D,
Rather than going for splunkd.log you can search in splunk metadata command. You wont be finding any indication in the splunkd.log if is has been stopped for monitoring because splunk will keep on monitoring but doesn't actually read anything unless it has changed state.

|metadata type=sources index=Index_Name|where source like '%part_of_Source%'

Of course you wont be able to find if there are many hosts having the same source names.


0 Karma


You can check the same by running ./splunk list monitor command on the forwarder

0 Karma


Yes this command will show me the inputs that Splunk is currently monitoring. It does not indicate if one of these monitored inputs is no longer being indexed for any given reason.

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...