https://community.splunk.com/t5/Splunk-Search/How-to-determine-if-forwarder-weight-distribution-is-good-from/m-p/472045#M132813 <P>I need help figuring something out.<BR /><BR /> Got this search during .conf19 to be used to do a Forwarder weight distribution search:</P> <PRE><CODE>index=_internal Metrics sourcetype=splunkd TERM(group=tcpin_connections) earliest=-4hr latest=now [|dbinspect index=_* |stats values(splunk_server) as indexer |eval search="host IN (".mvjoin(mvfilter(indexer!=""),",").")"] |stats sum(kb) as throughput by hostname |sort - throughput |eventstats sum(throughput) as total_throughput dc(hostname) as all_forwarders |streamstats sum(throughput) as accumlated_throughput count by all_forwarders |eval coverage=accumlated_throughput/total_throughput, progress_through_forwarders=count/all_forwarders |bin progress_through_forwarders bins=100 |stats max(coverage) as coverage by progress_through_forwarders all_forwarders |fields progress_through_forwarders coverage </CODE></PRE> <P>How do I interpret the results from this search? If the numerical representation of coverage is within 0.1 across all results is that success? Across 100 results, the coverage values range from 0.82594059014 to 1.0000000. </P> Wed, 30 Oct 2019 15:43:57 GMT mhouse 2019-10-30T15:43:57Z https://community.splunk.com/t5/Splunk-Search/How-to-determine-if-forwarder-weight-distribution-is-good-from/m-p/472045#M132813 <P>I need help figuring something out.<BR /><BR /> Got this search during .conf19 to be used to do a Forwarder weight distribution search:</P> <PRE><CODE>index=_internal Metrics sourcetype=splunkd TERM(group=tcpin_connections) earliest=-4hr latest=now [|dbinspect index=_* |stats values(splunk_server) as indexer |eval search="host IN (".mvjoin(mvfilter(indexer!=""),",").")"] |stats sum(kb) as throughput by hostname |sort - throughput |eventstats sum(throughput) as total_throughput dc(hostname) as all_forwarders |streamstats sum(throughput) as accumlated_throughput count by all_forwarders |eval coverage=accumlated_throughput/total_throughput, progress_through_forwarders=count/all_forwarders |bin progress_through_forwarders bins=100 |stats max(coverage) as coverage by progress_through_forwarders all_forwarders |fields progress_through_forwarders coverage </CODE></PRE> <P>How do I interpret the results from this search? If the numerical representation of coverage is within 0.1 across all results is that success? Across 100 results, the coverage values range from 0.82594059014 to 1.0000000. </P> Wed, 30 Oct 2019 15:43:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-determine-if-forwarder-weight-distribution-is-good-from/m-p/472045#M132813 mhouse 2019-10-30T15:43:57Z https://community.splunk.com/t5/Splunk-Search/How-to-determine-if-forwarder-weight-distribution-is-good-from/m-p/472046#M132814 <P>Hi mhouse,<BR /> did you already explored the Management Console?<BR /> probably there's that you're searching: I used it for a customer some months ago.</P> <P>Ciao.<BR /> Giuseppe</P> Wed, 30 Oct 2019 16:57:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-determine-if-forwarder-weight-distribution-is-good-from/m-p/472046#M132814 gcusello 2019-10-30T16:57:18Z https://community.splunk.com/t5/Splunk-Search/How-to-determine-if-forwarder-weight-distribution-is-good-from/m-p/472047#M132815 <P>I don't understand your question. I ran my query on the SH and I am seeking help in understanding the results.</P> Wed, 30 Oct 2019 17:00:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-determine-if-forwarder-weight-distribution-is-good-from/m-p/472047#M132815 mhouse 2019-10-30T17:00:17Z https://community.splunk.com/t5/Splunk-Search/How-to-determine-if-forwarder-weight-distribution-is-good-from/m-p/472048#M132816 <P>If you are using indexer discovery, then the monitoring console on the master will provide a tremendous amount of information regarding your forwarders. Including status, thruput, distribution, and much more.</P> Wed, 30 Oct 2019 19:17:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-determine-if-forwarder-weight-distribution-is-good-from/m-p/472048#M132816 codebuilder 2019-10-30T19:17:23Z