A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?
Trap 1: splunk list inputs
This only lists the input configurations, not whether data is actually indexed.
Trap 2: splunk status
This only checks if the Splunk processes are running.
Trap 3: splunk show conf
This shows configuration file contents, not indexed data.
- A
splunk list inputs
Why it fails: This only lists the input configurations, not whether data is actually indexed.
- B
splunk search "index=* sourcetype=your_type" | head 10
Running splunk search with index=* and the sourcetype filter queries indexed events directly, confirming whether the new input is actually producing searchable data on the indexer, satisfying the requirement to verify ingestion for that sourcetype.
- C
splunk status
Why it fails: This only checks if the Splunk processes are running.
- D
splunk show conf
Why it fails: This shows configuration file contents, not indexed data.