splunk stream verify

Splunk Data Stream Processor

Hi. My environment is running splunk stream app.

Logs from my windows environment servers are streamed to a heavy forwarder and then out to splunk cloud.

The index it falls under is: index=stream

I am trying to determine if a particular windows server stream data is making it. The streamfwd process on the server is running. The server is named: server1

At the indexer, I tried running a search of this but nothing returns: index=stream host=server1

If I run a search like this, I see one HOST and 100+ hostnames in the same event: index=stream hostname{}=server1

Any recommendation?

Get Updates on the Splunk Community!

Splunk Enterprise Security: An Automated Phishing Response Workflow

Originally posted on Splunk.com. Key takeaways The volume of phishing emails can overwhelm even the most ...

Sharper ES Detections, Agentic AI Integrations, Smarter Workload Management, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...