How can i find only SH replication errors ?

Deployment Architecture

I'm currently running Splunk 6.5.3

I want to create a KPI based on search heads replication errors.

I found this search :

index="_internal" sourcetype=splunkd replicate log_level=ERROR component=SHCRepJob

I can see search heads on host fields but it seem to be too much result.

Have a better idea ?

How can i find all replications errors (lookup, etc ..) ?

64 KB

Get Updates on the Splunk Community!

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...

Join the Conversation