Getting Data In

How can one determine on system level if a Splunk install is a Heavy Forwarder or an Indexer?

New Member

Hi team,

I'm looking to find a way to identify if a Splunk server is a heavy forwarder or an Indexer in an automated way.

Is there a way to find out, by looking at filesystems, processes or running commands, on the system to identify the role of the server in Splunk?

I'm looking forward to your feedback, its highly appreciated.

0 Karma

Path Finder

Forwarders have outputs.conf configured to send the data to indexers.

Indexers have indexes.conf and best to confirm is see the size of db files.
from UI:
goto setting--> Data(indexes) and if there are good size in "Current_data" it means its an indexer.
from CLI:
du -h /| grep '[0-9.]+G'
if u find the index are having high disk space usage u can guess its an indexer.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!