Getting Data In

Is there a way to check what sourcetypes a universal forwarder is sending to a heavy forwarder?

Path Finder

hi there,

Is there a way to check what sourcetypes a universal forwarder is sending to heavy forwarder. Any query or CLI command ?

0 Karma

Splunk Employee
Splunk Employee

Try using btool on the Universal forwarder to list all of the inputs:

./splunk cmd btool inputs list —debug

Path Finder

Thank you for the reply.is there any way to know where the universal forwarder is sending the sourcetype to ( i mean to which heavy forwarder )

0 Karma

Splunk Employee
Splunk Employee

You could take a look at the outputs.conf file on the forwarder.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!