How do I verify the forwarder is sending data to the indexer?

[rodneymitch80]

How do i verify the forwarder is sending data to the Indexer? What search do i need to perform other then Forwarder Management?

[gcusello]

Hi @rodneymitch80 ,

at first you can run a simple search like this:

index=_internal host=<your_host>

to be sure that the UF is connected and configured.

then running this search:

index=* host=<your_host>

you can verify if the predefined inputs are correctly running.

Ciao.

Giuseppe

[rodneymitch80]

@gcusello Thank you for knowledge and expertise. I'm a newbie with Splunk so i'm just trying to start somewhere and build from there. 

[gcusello]

Hi @rodneymitch80,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

HI @rodneymitch80,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉