How can i find only SH replication errors ?

Deployment Architecture

I'm currently running Splunk 6.5.3

I want to create a KPI based on search heads replication errors.

I found this search :

index="_internal" sourcetype=splunkd replicate log_level=ERROR component=SHCRepJob

I can see search heads on host fields but it seem to be too much result.

Have a better idea ?

How can i find all replications errors (lookup, etc ..) ?

64 KB

Get Updates on the Splunk Community!

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...