Getting Data In

Splunk forwarder

Path Finder

How to check inputs.conf file to see the how the log files are being sent to splunk. 


How to check forwarder is running and moved data to splunk index? 

0 Karma


Hi @kajalchopade071,

you can check if a Forwarder is running searching in _internal index, something like this:

index=_internal host=your_host

if you have results, Forwarder is up and running.

To check if a Forwarder is sending a kind of logs, you have to do the same thing in the index containing the logs to check.

if you have many hosts to monitor, you have to create a lookup (called e.g. perimeter.csv), containing all the hosts to monitor (e.g. in a column called host) and run a little more comples search:

| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0



Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...