hi there,
Is there a way to check what sourcetypes a universal forwarder is sending to heavy forwarder. Any query or CLI command ?
Try using btool on the Universal forwarder to list all of the inputs:
./splunk cmd btool inputs list —debug
Thank you for the reply.is there any way to know where the universal forwarder is sending the sourcetype to ( i mean to which heavy forwarder )
You could take a look at the outputs.conf file on the forwarder.
