https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324348#M12126 <P>Yup. I dont see SH mentioned in the host field. I should have mentioned that in my question. </P> Wed, 06 Sep 2017 10:59:42 GMT varad_joshi 2017-09-06T10:59:42Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324344#M12122 <P>I followed the steps mentioned on below link to send internal logs from SH to indexer.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Forwardsearchheaddata">http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/Forwardsearchheaddata</A></P> <P>Now I am looking for a way to check and validate that I am receiving internal logs from SH to my indexer. How do I do that? </P> Wed, 06 Sep 2017 10:22:06 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324344#M12122 varad_joshi 2017-09-06T10:22:06Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324345#M12123 <P>This should do it:</P> <PRE><CODE>index=_internal host=searchheadhostname </CODE></PRE> <P>If there are events returned, it should be working.</P> Wed, 06 Sep 2017 10:41:46 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324345#M12123 cpetterborg 2017-09-06T10:41:46Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324346#M12124 <P>Hi varad_joshi,<BR /> did you tried</P> <PRE><CODE>index=_internal host=SH_hostename </CODE></PRE> <P>?<BR /> Bye.<BR /> Giuseppe</P> Wed, 06 Sep 2017 10:41:58 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324346#M12124 gcusello 2017-09-06T10:41:58Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324347#M12125 <P>Jinx!</P> <P>@cusello - E una cosa Americana di dirlo quando diciamo la stessa cosa allo stesso tempo. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Auguri!</P> Wed, 06 Sep 2017 10:50:54 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324347#M12125 cpetterborg 2017-09-06T10:50:54Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324348#M12126 <P>Yup. I dont see SH mentioned in the host field. I should have mentioned that in my question. </P> Wed, 06 Sep 2017 10:59:42 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324348#M12126 varad_joshi 2017-09-06T10:59:42Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324349#M12127 <P>I dont see SH mentioned in the host field. I should have mentioned that in my question. So events are not being moved to indexer. Right?</P> Wed, 06 Sep 2017 11:00:47 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324349#M12127 varad_joshi 2017-09-06T11:00:47Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324350#M12128 <P>Sounds like that is correct.</P> <P>Be sure you are forwarding your events to the indexers. You can do it in the GUI, too. If you don't set it up to forward, then they will stay on the SH. It's like you would do on an HF.</P> Wed, 06 Sep 2017 11:07:45 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324350#M12128 cpetterborg 2017-09-06T11:07:45Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324351#M12129 <P>Have a look to this url and review your config according to that:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata">http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata</A></P> <P>Hope this helps you</P> Wed, 06 Sep 2017 11:11:16 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324351#M12129 Javip 2017-09-06T11:11:16Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324352#M12130 <P>OK thanks!<BR /> Bye.<BR /> Giuseppe</P> Wed, 06 Sep 2017 11:12:17 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324352#M12130 gcusello 2017-09-06T11:12:17Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324353#M12131 <P>I used that URL to start forwarding internal logs. Now I want to validate the logs are coming to indexer. </P> Thu, 07 Sep 2017 07:18:35 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324353#M12131 varad_joshi 2017-09-07T07:18:35Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324354#M12132 <P>Ahh, ok, I thought you were wrong with Splunk version or so ...</P> <P>The logs are not coming to your indexer, but are they still accesible in your SH? Have you read them if they show you some kind of problem/error?<BR /> Have you checked communication in port 9997 between SH and indexers?</P> <P>Regards.</P> Thu, 07 Sep 2017 10:28:51 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324354#M12132 Javip 2017-09-07T10:28:51Z https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324355#M12133 <P>I think I finally understand what you need. </P> <P>If you look at the field <CODE>splunk_server</CODE> on the data from the search that cusello and I answered with, that will tell you which host the data was indexed on. If the field has your indexer, then it is working. If it is the search head, then it is not.</P> <P>Hopefully I understood your dilemma correctly.</P> Thu, 07 Sep 2017 12:17:02 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-see-Internal-logs-which-are-sent-from-Search-Head-to/m-p/324355#M12133 cpetterborg 2017-09-07T12:17:02Z