Deployment Architecture

multiple forwarders list monitor


I recently set up a SuSE box with 8 4.1.7 splunk light forwarders (running on different ports, configured in different directories).

'splunk list monitor' results appear to be mangled.

I can see which files each splunk forwarder has open by looking /proc/splunk pid/fd.

However, when I run 'splunk list monitor' (with the correct PATH, LD_LIBRARY_PATH, SPLUNK_HOME settings for a specific forwarder) I get a mix of files from all 8 forwarders.

Is that command talking to the indexer to get the information?

Tags (1)

Esteemed Legend

The splunk list monitor command should be run on individual forwarders, not the indexer. The command only lists what is being monitored on the server on which the command is run so running on the indexer will only show you the stuff that Splunk is sending to itself from the indexer to _internal.

0 Karma

Splunk Employee
Splunk Employee

Mangled how? The "list monitor" command only shows files being monitored on the local instance (unless the command target is modified via -uri).

Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...