Deployment Architecture

multiple forwarders list monitor

rotten
Communicator

I recently set up a SuSE box with 8 4.1.7 splunk light forwarders (running on different ports, configured in different directories).

'splunk list monitor' results appear to be mangled.

I can see which files each splunk forwarder has open by looking /proc/splunk pid/fd.

However, when I run 'splunk list monitor' (with the correct PATH, LD_LIBRARY_PATH, SPLUNK_HOME settings for a specific forwarder) I get a mix of files from all 8 forwarders.

Is that command talking to the indexer to get the information?

Tags (1)

woodcock
Esteemed Legend

The splunk list monitor command should be run on individual forwarders, not the indexer. The command only lists what is being monitored on the server on which the command is run so running on the indexer will only show you the stuff that Splunk is sending to itself from the indexer to _internal.

0 Karma

amrit
Splunk Employee
Splunk Employee

Mangled how? The "list monitor" command only shows files being monitored on the local instance (unless the command target is modified via -uri).

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!