Splunk Enterprise

Splunk Docker Keeps Receiving Events When Forwarder is Off

New Member

I recently setup a Docker implementation on a Test Server (CentOS 8). Pulled down the Splunk Base Enterprise container and got it working with no issues. Obviously there were no events going to it since I hadn't pulled a universal forwarder yet. So I pulled down the UF and got it working too and events started flowing into my Splunk base container - all was good. Then I shut down the server and have several times since but when I start the base Splunk container and leave the forwarder off - I am still getting events flowing into base Splunk container. It doesn't seem to matter if I start the forwarder or leave it off - I still get events. Is this normal behavior? I cannot find any documentation on why I would still be getting events with the forwarder off.

Tags (1)
0 Karma


Yes this is 100000% normal because Splunk is continuously monitoring itself. Even though your universal forwarder container is turned off and/or not sending data to your base Splunk container, that base Splunk container continues to ingest data from itself.

See this Splunk Docs page on What Splunk software logs about itself

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...