topic Re: Sourcetype by Forwarder GUID in Getting Data In

Sourcetype by Forwarder GUID

mwdbhyat — Thu, 05 Nov 2020 16:25:11 GMT

Hi there,

I have 2 forwarders on a single box - one HF one UF. I want to switch off the UF. Im looking for a list of sourcetypes that the UF is sending. Does anyone have a search that can tell me what sourcetypes are actively sending data to Splunk via the UF's GUID ?

Thanks!

Re: Sourcetype by Forwarder GUID

isoutamo — Thu, 05 Nov 2020 16:53:53 GMT

Have both forwarders the sane server name on server.conf?
If yes is it option to use different?

Re: Sourcetype by Forwarder GUID

mwdbhyat — Thu, 05 Nov 2020 16:56:05 GMT

They both use the same - right now no option to change. I know i can use btool and list monitor to get a list of inputs.. but was hoping there was a way of generating a more "active" result from search.

Re: Sourcetype by Forwarder GUID

isoutamo — Thu, 05 Nov 2020 16:59:58 GMT

You could get some info from metrics.log on those nodes. It tells 10 top source, sourcetypes etc. at time. Just switch those to the HF and wait some time to look next round. Probably you could found same information from indexer side also with GUID, but probably it’s easier to check with Greg etc from command line.