Splunkweb running or not on the forwarder

[Cris]

How can I check if the splunkweb service is started or not on the heavy forwarders?

Have I to index the web_service.log files for every forwarder and check it or is there a better way?

[npandith]

By default splunk forwarder will forward all the splunk logs to the indexer. If you have a look at inputs.conf under /opt/splunkforwarder/etc/system/local you can see that all the logs are being monitored.

[monitor://$SPLUNK_HOME/var/log/splunk]
index = _internal

You can also run "$SPLUNK_HOME/bin/splunk list monitor" to find what logs are being monitored.

[Cris]

Thank you for your answer.
I apologize but maybe my question was not very clear.
I meant to check the splunkweb service of the forwarders from the main indexer-searcher using a search command or an app without going on every server an launch the the status command.

[gkanapathy]

forwarders can send their internal logs to the indexers. whether they do this by default depends on the exact forwarder configuration as well as the specific version of the forwarder.

[gkanapathy]

You can just run:

$SPLUNK_HOME/bin/splunk status splunkweb