Getting Data In

determining where an event originated

a212830
Champion

Hi,

I have some syslog messages that I want to turn off from my sandbox. They are coming in from 3 potential servers. I removed the logfile form the inputs.conf, and bounced the forwarders, but they are still coming in. Since the host on these messages point to the originating device (not the forwarder host), how can I determine where they are coming from? I stopped each of the forwarders, and I still see them coming in.

0 Karma

MHibbin
Influencer

In addition to @dskillman's response... You can use "btool" to quickly list all the "inputs.conf" files in your instance (as you could have many apps).

Docs are http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

An example of the command would be (from you $SPLUNK_HOME/bin directory):

./splunk cmd btool inputs list

If your forwarders are "turned off" I would recommend looking for local "file monitors" (i.e. on the system you're on) and UDP/TCP ports as inputs.

0 Karma

yannK
Splunk Employee
Splunk Employee

What are the host/sourcetype/source/index associated with the events ?

If this is syslog, or if the host is extracted from the event, maybe, you may have a port open accepting data ( check tcp or udp inputs)

0 Karma

dskillman
Splunk Employee
Splunk Employee

Sounds like you have some local inputs on your indexer. What does your inputs.conf look like on your indexer?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...