Getting Data In

Splunk forwarder

kajalchopade071
Path Finder

How to check inputs.conf file to see the how the log files are being sent to splunk. 

 

How to check forwarder is running and moved data to splunk index? 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kajalchopade071,

you can check if a Forwarder is running searching in _internal index, something like this:

index=_internal host=your_host

if you have results, Forwarder is up and running.

To check if a Forwarder is sending a kind of logs, you have to do the same thing in the index containing the logs to check.

if you have many hosts to monitor, you have to create a lookup (called e.g. perimeter.csv), containing all the hosts to monitor (e.g. in a column called host) and run a little more comples search:

| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

 Ciao.

Giuseppe

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...