Is there some way to see the current tailing status?

[the_wolverine]

Is there a splunk command or REST endpoint to see the tailing status of monitored files?

[the_wolverine · Accepted solution]

Try hitting this url:

https://yoursplunkhost:8089/services/admin/inputstatus/TailingProcessor%3AFileStatus

• replace yoursplunkhost with your splunk server name
• replace 8089 with your configured mgmt port number.

This only works if you changed the admin password on the Splunk instance/universal forwarder.

Otherwise you can run this command on the host:

./splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus

[jrodman]

This is a great question, if only it had an answer. Oh wait?