https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48122#M11485 <P>Thanks!</P> <P>One more question: What is the value of this field: -the indexer hostname where the data got indexed originally or -the indexer hostname from which the data was sent to the search head for the current search?</P> <P>Best regards,<BR /> Bartosz Maruszewski</P> Tue, 22 Feb 2011 18:53:28 GMT tzhmaba2 2011-02-22T18:53:28Z https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48120#M11483 <P>Hi,</P> <P>Is there a way to search for data which has been sent to a specific indexer? I want to make a test (to check our recover scenario):<BR /> - stop one indexer (even power off now)<BR /> - unmount the SAN LUN whith index data and mount this LUN to another indexer<BR /> - start splunk and clean or reindex the index<BR /> - see if the data from the "broken" indexer are correctly seen on the test indexer.</P> <P>Any ideas?</P> <P>Best regards, Bartosz Maruszewski</P> Tue, 22 Feb 2011 00:08:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48120#M11483 tzhmaba2 2011-02-22T00:08:11Z https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48121#M11484 <P>You should have a field called "splunk_server", that's what indexer it came from.</P> <P>You should be able to search / display based on that.</P> <P>Brian</P> Tue, 22 Feb 2011 00:48:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48121#M11484 Brian_Osburn 2011-02-22T00:48:38Z https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48122#M11485 <P>Thanks!</P> <P>One more question: What is the value of this field: -the indexer hostname where the data got indexed originally or -the indexer hostname from which the data was sent to the search head for the current search?</P> <P>Best regards,<BR /> Bartosz Maruszewski</P> Tue, 22 Feb 2011 18:53:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48122#M11485 tzhmaba2 2011-02-22T18:53:28Z https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48123#M11486 <P>Its the indexer where the data was sent to from the forwarder.</P> Wed, 23 Feb 2011 02:11:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48123#M11486 Brian_Osburn 2011-02-23T02:11:37Z https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48124#M11487 <P>Thanks very much!</P> Thu, 24 Feb 2011 17:54:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48124#M11487 tzhmaba2 2011-02-24T17:54:43Z https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48125#M11488 <P>Do you know is there a way that we can tell a search to only distribute to a specific indexer? - The above solution will indeed show results from only one indexer. But i believe that the search is still distributed to all indexers, but only SHOWS results from the indexer specified.</P> <P>I am hoping to find a way to limit what indexer(s) the search is initially distributed to.</P> <P>Can anyone help here???</P> <P>Thanks!</P> <P>John</P> Thu, 08 Dec 2011 08:51:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-see-data-from-a-specific-indexer/m-p/48125#M11488 jdunlea_splunk 2011-12-08T08:51:38Z