Splunk Enterprise

find out which Splunk server received the event.


I all as an architect sometimes I find myself in environment where the inputs are misconfigured and splunk servers are receiving traffic directly. For example the search head and indexer receiving traffic directly even if a syslog server/HF is present in the environment. Is there a search with which I can find out each source type and which Splunk  server is receiving the logs and forwarding it to the indexer layer. This will really help in resolving issues.



0 Karma


Hi @rabrahaham,

You can find your forwarders destinations using below search, normally you should not see an address other than indexer or heavy forwarder. 

index=_internal component=TcpOutputProc 
| stats count by idx


If this reply helps you an upvote is appreciated.


Forwarding is transparent so there's no indication of where an event was forwarded from (unless you've taken actions to add something).

Check your search heads and indexers for inputs.conf files and remove any TCP or UDP inputs.

If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>