Getting Data In

Splunk forwarder

Path Finder

How to check inputs.conf file to see the how the log files are being sent to splunk. 


How to check forwarder is running and moved data to splunk index? 

0 Karma


Hi @kajalchopade071,

you can check if a Forwarder is running searching in _internal index, something like this:

index=_internal host=your_host

if you have results, Forwarder is up and running.

To check if a Forwarder is sending a kind of logs, you have to do the same thing in the index containing the logs to check.

if you have many hosts to monitor, you have to create a lookup (called e.g. perimeter.csv), containing all the hosts to monitor (e.g. in a column called host) and run a little more comples search:

| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0



Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...