multiple forwarders list monitor

[rotten]

I recently set up a SuSE box with 8 4.1.7 splunk light forwarders (running on different ports, configured in different directories).

'splunk list monitor' results appear to be mangled.

I can see which files each splunk forwarder has open by looking /proc/splunk pid/fd.

However, when I run 'splunk list monitor' (with the correct PATH, LD_LIBRARY_PATH, SPLUNK_HOME settings for a specific forwarder) I get a mix of files from all 8 forwarders.

Is that command talking to the indexer to get the information?

[woodcock]

The splunk list monitor command should be run on individual forwarders, not the indexer. The command only lists what is being monitored on the server on which the command is run so running on the indexer will only show you the stuff that Splunk is sending to itself from the indexer to _internal.

[amrit]

Mangled how? The "list monitor" command only shows files being monitored on the local instance (unless the command target is modified via -uri).