How can I check if the splunkweb service is started or not on the heavy forwarders?
Have I to index the web_service.log files for every forwarder and check it or is there a better way?
By default splunk forwarder will forward all the splunk logs to the indexer. If you have a look at inputs.conf under /opt/splunkforwarder/etc/system/local you can see that all the logs are being monitored.
[monitor://$SPLUNK_HOME/var/log/splunk]
index = _internal
You can also run "$SPLUNK_HOME/bin/splunk list monitor" to find what logs are being monitored.
Thank you for your answer.
I apologize but maybe my question was not very clear.
I meant to check the splunkweb service of the forwarders from the main indexer-searcher using a search command or an app without going on every server an launch the the status command.
forwarders can send their internal logs to the indexers. whether they do this by default depends on the exact forwarder configuration as well as the specific version of the forwarder.
You can just run:
$SPLUNK_HOME/bin/splunk status splunkweb