check a forwarder is working.

[kristiaan_d]

Hi can someone tell me how i check that splunk is actually forwarding data from the server its running as a forwarder on to the PC that is indexing the data??

i have setup one PC to forward data to another pc inside my office, and setup the indexing pc to receive the data but so far nothing has come through.

there are no firewalls or routers or proxies in the way as both pcs on the same internal network a few ip addresses apart.

[kristiaan_d]

OK this problem has been resolved and is now working. simple reason for it, on a default install of splunk it does not index any data at all..

so even though the data inputs window shows there are data inputs none of them are being monitored by default you have to enable them in the manager interface.

[David]

The easiest way if you think it's working is to do a search for host="ClientPC*" and see if any results come up. Alternatively, you can go into the indexing volume report ( http://YourHost:8000/en-US/app/search/indexing_volume ), split by host and look for the client.

There's also an app in the splunkbase that will help you monitor forwarders: http://splunkbase.splunk.com/apps/All/4.x/App/app:Splunk+Monitoring (I've never used it, but I know it is intended to help monitor forwarders on an ongoing basis).

You can also look at the splunkd.log at $SPLUNK_HOME/var/log/splunk/splunkd.log which should provide some error messages, if nothing is coming through.