Splunk Forwarder Collectors — Every Collection Point, Input by Input
The heavy forwarders that run your DB Connect, cloud and API add-ons, scripted and modular inputs, and the forwarders reading syslog files: every input as configured, judged by what it delivers and the errors it writes — not only by whether it runs. 28 built-in policies, nothing installed.
Key Capabilities
Every Input, as Configured
TrackMe knows no add-on in particular: it lists each input an operator configured on each collector — add-ons, scripted and modular inputs, DB Connect, syslog and file inputs — with its state, the data it delivered and its errors.
Running Is Not Working
A failing add-on may keep logging as usual. An input is judged by what it delivers, by the errors it writes on stderr and in its own logs, by a signal that went quiet, and by whether it stays enabled.
Feeds That Go Quiet
Each feed learns its own rhythm. A feed that stays quiet three times longer than its longest gap ever opens a finding — never a false alarm on a weekly pause.
28 Built-In Policies
Collectors not reporting, output blocked, queues and pipeline saturated, disk filling, input errors and crash loops, inputs disabled that must stay enabled, groups below their minimum of healthy members — plus custom SPL policies.
Syslog Collectors, Declared
Nothing in Splunk says that a forwarder collects other machines' data from files: declare your syslog collectors on a group, with a minimum of healthy members, and a pool losing a member is a finding.
Your Inputs, Your Rules
Mark the inputs that must stay enabled; exclude one input from one policy from a finding or the Policies tab, while its other policies keep judging it.
Zero-Footprint, Optional API
Reads each collector's metrics.log, splunkd.log, _introspection and _configtracker that Splunk already forwards. An optional read-only API account per collector adds the current list of its inputs.
A Findings AI Agent of Its Own
The Splunk Forwarder Collectors AI Agent reviews open findings, with traffic ML models per collector and group behind it, and recommends or applies the triage the tenant allows.
Every input, per collector
The inputs each collector runs, as configured, with their state — running, delivering, logging, no activity evidence — the data they delivered and the errors they wrote.
One collector up close
Collected and forwarded throughput, inputs active, input errors, queues, CPU, memory and disk, and the error lines behind them.
Groups with a minimum
A syslog pool below its minimum of healthy members is one finding, naming the collector that is not reporting.
The fleet map
Groups, collectors and their state drawn for Topology Studio, live, and saved as a view in one click.
Deep Dive
Explore the key aspects of Forwarder Collectors in detail.
The collection points, watched
Your heavy forwarders run the inputs that bring data in from databases, clouds and APIs; your syslog collectors write the files other machines send. When one of them stops collecting while the forwarder still reports, the feed simply ends. The Splunk Forwarder Collectors tenant answers the questions an admin asks: is every input collecting? Which inputs stopped, crash in a loop, write errors, went quiet, or were disabled when they must stay enabled? Is the collector itself reporting, forwarding? Does each group keep enough healthy members?
It reads what Splunk already writes; nothing is installed on a collector and no new data is ingested.
Read the Splunk Forwarder Collectors guide or take the guided tour.
Related Features
Ready to get started?
Request a free 90-day trial with all features enabled. No restrictions.