topic Re: Forwarders hosts are also being displayed as consumed data in Getting Data In

Forwarders hosts are also being displayed as consumed data

rakesh_498115 — Mon, 28 Sep 2020 14:00:45 GMT

I have used the following query to find indexer host wise mb consumed in indexeing.

index=_internal source=*metrics.log group=per_index_thruput series="Myindex" | eval MB=kb/1024 | stats sum(MB) by host | addcoltotals

but in this list i could see my forwarders hosts are also being displayed...and the Myindex is having almost double size of the data... can you pls help ?? wat needs to be checked to solve this problem ?

Re: Forwarders hosts are also being displayed as consumed data

rakesh_498115 — Tue, 02 Jul 2013 19:21:01 GMT

any update on this pls ??

Re: Forwarders hosts are also being displayed as consumed data

grijhwani — Thu, 04 Jul 2013 20:52:42 GMT

Are your forwarders set to index AND forward, or forward only?

Alternatively, is there some mechanism whereby you could be capturing the same information twice, or forwarding it to multiple indexers? And what version Splunk are you running? Older versions will see the same data directed at multiple indexers as separately accountable.

Re: Forwarders hosts are also being displayed as consumed data

rakesh_498115 — Wed, 10 Jul 2013 17:19:50 GMT

my fowaders are meant for fwd only..all are UF's

splunk version 4.3.2
fwd 5.0