Getting Data In

Splunk forwarder

Path Finder

How to check inputs.conf file to see the how the log files are being sent to splunk. 


How to check forwarder is running and moved data to splunk index? 

0 Karma


Hi @kajalchopade071,

you can check if a Forwarder is running searching in _internal index, something like this:

index=_internal host=your_host

if you have results, Forwarder is up and running.

To check if a Forwarder is sending a kind of logs, you have to do the same thing in the index containing the logs to check.

if you have many hosts to monitor, you have to create a lookup (called e.g. perimeter.csv), containing all the hosts to monitor (e.g. in a column called host) and run a little more comples search:

| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0



Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...