How can i find only SH replication errors ?

Deployment Architecture

I'm currently running Splunk 6.5.3

I want to create a KPI based on search heads replication errors.

I found this search :

index="_internal" sourcetype=splunkd replicate log_level=ERROR component=SHCRepJob

I can see search heads on host fields but it seem to be too much result.

Have a better idea ?

How can i find all replications errors (lookup, etc ..) ?

1 KB

Get Updates on the Splunk Community!

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...