How can i find only SH replication errors ?

Deployment Architecture

I'm currently running Splunk 6.5.3

I want to create a KPI based on search heads replication errors.

I found this search :

index="_internal" sourcetype=splunkd replicate log_level=ERROR component=SHCRepJob

I can see search heads on host fields but it seem to be too much result.

Have a better idea ?

How can i find all replications errors (lookup, etc ..) ?

1 KB

Get Updates on the Splunk Community!

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Watch Now! In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...