confirm if heavy forwarder is receiving any data.

[vikram_m]

We have 6.5 Splunk instance configured as a heavy forwarder.

We are forwarding data from Cloud PAAS service and that is reason logs which are forwarded are from an API so we dont have any IP to check if connectivity is possible but the team governing the PAAS tool is suggesting it has already configured to forward the data to Splunk.

Now, in the Heavy forwarder which we configured how can we confirm if it is reachable to the PAAS tool or it is getting any data from the tool.

THanks.
Vikram.

[woodcock]

Assuming that your HV is linux-based (it had better be, for your own benefit), you can just do a packet capture like this:

tcpdump -n host YOUR.FORWARDER.IP.HERE