Monitoring Splunk

Trouble-shooting events forwarded from a heavy forwarder.

Path Finder


Are there searches or any log files that will tell me what is being forwarded from my heavy forwarder? 

I have a multi site, clustered splunk environment that ingests all its own personal logs first but then sends all of the data to a third party via a heavy forwarder and data diode. I do not have access to the data once they have been sent from the HF so i cannot assess what has been sent. 

Are there any splunk techniques, searches, log files i can view from my heavy forwarder to determine what data have been sent to the data diode? 

I can provide config files if required. 

Labels (3)
Tags (1)
0 Karma


One thing what you could try is adding that HF as indexer on you MC. Then it could shows some information what it has done e.g. what logs it has managed? This is nice way to see e.g. HEC statistic on HF. There is already item for thi (add HF as own type to MC or something similar) on

r. Ismo

0 Karma

Super Champion

Hi @willsy  try this search.. 

index=_internal sourcetype=splunkd group=per_host_thruput host=<HF-Name>


index=_internal sourcetype=splunkd group=per_host_thruput 

then you can click host field on left side field selector, and select the HF manually. 

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

Path Finder

Hi @inventsekar what does that search specifically tell me? 

i am hoping that it is the hosts that are being forwarded by the HF if that is the case then bosh, my stuff works as it is meant to and your search gets the karma.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...