How can i find only SH replication errors ?

Deployment Architecture

I'm currently running Splunk 6.5.3

I want to create a KPI based on search heads replication errors.

I found this search :

index="_internal" sourcetype=splunkd replicate log_level=ERROR component=SHCRepJob

I can see search heads on host fields but it seem to be too much result.

Have a better idea ?

How can i find all replications errors (lookup, etc ..) ?

64 KB

Get Updates on the Splunk Community!

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Thursday, July 10, 2025 | 11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

Are you a member of the Splunk Community?