How do i verify the forwarder is sending data to the Indexer? What search do i need to perform other then Forwarder Management?
HI @rodneymitch80,
if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
Hi @rodneymitch80 ,
at first you can run a simple search like this:
index=_internal host=<your_host>
to be sure that the UF is connected and configured.
then running this search:
index=* host=<your_host>
you can verify if the predefined inputs are correctly running.
Ciao.
Giuseppe
@gcusello Thank you for knowledge and expertise. I'm a newbie with Splunk so i'm just trying to start somewhere and build from there.
Hi @rodneymitch80,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
HI @rodneymitch80,
if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉