topic Re: Identifying forwarders from indexer in Getting Data In

Identifying forwarders from indexer

glenngermiathen — Fri, 24 May 2013 20:08:11 GMT

With almost no experience I recently was appointed as Splunk admin when the previous one quit. There is no documentation on how the system is set up so the first thing I am trying to do is get an idea of how everything works together. I am working with Ubuntu indexers and a windows search head. How can I tell which systems are forwarding to the indexers, and where is the config for archiving located on the indexer? Any other help is greatly appreciated too.

Re: Identifying forwarders from indexer

bmacias84 — Fri, 24 May 2013 20:21:03 GMT

Every instance of Splunk can potentially be a forwarder and full instances can be search head, indexer, Forwarder, Deployment server, and licensing server. From the search head in manage look for who are its search peers which should tell you who are indexers. Indexer settings are located in index.conf but index.conf can be located in apps and under system.

Re: Identifying forwarders from indexer

kristian_kolb — Fri, 24 May 2013 21:26:18 GMT

You could install the Splunk Deployment Monitor app, unless you already have it installed. It will show you some metrics, and the general health of your forwarders.

Not a lot of time for knowledge transfer?

Re: Identifying forwarders from indexer

martin_mueller — Fri, 24 May 2013 21:27:57 GMT

The easiest way for a novice to get a first glimpse into your forwarders is to take a look at the "All Forwarders" view in the Deployment Monitor app. If your installation does not already have it you can get it here: http://splunk-base.splunk.com/apps/67836/splunk-deployment-monitor / http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor-4x

Re: Identifying forwarders from indexer

glenngermiathen — Tue, 28 May 2013 19:20:40 GMT

Using the app now it is a big help.