topic Re: How can one determine on system level if a Splunk install is a Heavy Forwarder or an Indexer? in Getting Data In

How can one determine on system level if a Splunk install is a Heavy Forwarder or an Indexer?

mspanhaak — Tue, 25 Sep 2018 12:51:01 GMT

Hi team,

I'm looking to find a way to identify if a Splunk server is a heavy forwarder or an Indexer in an automated way.

Is there a way to find out, by looking at filesystems, processes or running commands, on the system to identify the role of the server in Splunk?

I'm looking forward to your feedback, its highly appreciated.
Thanks.

Re: How can one determine on system level if a Splunk install is a Heavy Forwarder or an Indexer?

neelamsantosh — Tue, 25 Sep 2018 13:56:30 GMT

Forwarders have outputs.conf configured to send the data to indexers.

Indexers have indexes.conf and best to confirm is see the size of db files.
from UI:
goto setting--> Data(indexes) and if there are good size in "Current_data" it means its an indexer.
from CLI:
du -h /| grep '[0-9.]+G'
if u find the index are having high disk space usage u can guess its an indexer.