Is there a way to figure out the host and the sourcetype for the log going to null queue

[ss026381]

We are using regex rule to send specific logs to nullQueue. We use universal forwarders to send the logs to the indexer from different hosts. is there a way to list all the hosts and sourcetypes that are sending logs to nullQueue?

[MuS]

Hi ss026381,

I just had the exact same question lately and learned that Splunk does not log this kind of information. You can see in Splunk's logs how many times the nullQueue process has been called but not for what sourcetype, source, nor host. The only option to get this information, is to use btool on your props.conf to get the sourcetypes, sources, or hosts that call the nullQueue transforms.

Hope this helps ...

cheers, MuS