Is there a way to check what sourcetypes a universal forwarder is sending to a heavy forwarder?

[kteng2024]

hi there,

Is there a way to check what sourcetypes a universal forwarder is sending to heavy forwarder. Any query or CLI command ?

[kmorris_splunk]

Try using btool on the Universal forwarder to list all of the inputs:

./splunk cmd btool inputs list —debug

[kteng2024]

Thank you for the reply.is there any way to know where the universal forwarder is sending the sourcetype to ( i mean to which heavy forwarder )

[kmorris_splunk]

You could take a look at the outputs.conf file on the forwarder.