Splunk Enterprise

find out which Splunk server received the event.


I all as an architect sometimes I find myself in environment where the inputs are misconfigured and splunk servers are receiving traffic directly. For example the search head and indexer receiving traffic directly even if a syslog server/HF is present in the environment. Is there a search with which I can find out each source type and which Splunk  server is receiving the logs and forwarding it to the indexer layer. This will really help in resolving issues.



0 Karma


Hi @rabrahaham,

You can find your forwarders destinations using below search, normally you should not see an address other than indexer or heavy forwarder. 

index=_internal component=TcpOutputProc 
| stats count by idx


If this reply helps you an upvote is appreciated.


Forwarding is transparent so there's no indication of where an event was forwarded from (unless you've taken actions to add something).

Check your search heads and indexers for inputs.conf files and remove any TCP or UDP inputs.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...