topic Re: How can we identify forwarders which are not connected to certain indexers? in Getting Data In

How can we identify forwarders which are not connected to certain indexers?

ddrillic — Fri, 26 Aug 2016 19:24:53 GMT

The DMC shows us the following -

It shows the connected forwarders to the four indexers, the yellow line is actually two indexers one on top of the other.

How can we figure out which two hundred or so forwarders are not connected to the two newer indexers (the blue and purple) at the bottom of the chart?

Re: How can we identify forwarders which are not connected to certain indexers?

rharrisssi — Fri, 26 Aug 2016 19:28:01 GMT

I know this isn't what you're asking, but having hundreds of forwarders going directly to your indexers is against best practice. The Heavy Forwarder role should be intercepting these messages from the UFs and such and then forwarding them to the indexers.

This also allows you to do some preprocessing with transforms and props that would otherwise take resources away from your indexers.

Re: How can we identify forwarders which are not connected to certain indexers?

ddrillic — Mon, 29 Aug 2016 00:12:00 GMT

Jeff suggested -

-- You should be able to run a search on _internal for the last 24 hours looking for host whose count of splunk_server != 4.