Splunk Data Stream Processor

splunk stream verify

verifi81
Path Finder

Hi.  My environment is running splunk stream app.

Logs from my windows environment servers are streamed to a  heavy forwarder and then out to splunk cloud.

The index it falls under is: index=stream

I am trying to determine if a particular windows server stream data is making it. The streamfwd process on the server is running.  The server is named: server1

At the indexer, I tried running a search of this but nothing returns:  index=stream host=server1

If I run a search like this, I see one HOST and 100+ hostnames in the same event: index=stream hostname{}=server1

Any recommendation?

 

Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!