How to identify in the splunkd.log when Splunk is no longer monitoring a data input?

[Ant1D]

Hey,

Is there an event in splunkd.log which identifies when a stanza defined in inputs.conf which is not disabled is no longer being indexed?

Thanks in advance for your help

[linu1988]

Hello Ant1D,
Rather than going for splunkd.log you can search in splunk metadata command. You wont be finding any indication in the splunkd.log if is has been stopped for monitoring because splunk will keep on monitoring but doesn't actually read anything unless it has changed state.

|metadata type=sources index=Index_Name|where source like '%part_of_Source%'

Of course you wont be able to find if there are many hosts having the same source names.

Thanks,
L

[pradeepkumarg]

You can check the same by running ./splunk list monitor command on the forwarder

[Ant1D]

Yes this command will show me the inputs that Splunk is currently monitoring. It does not indicate if one of these monitored inputs is no longer being indexed for any given reason.