Getting Data In

How can we identify forwarders which are not connected to certain indexers?

ddrillic
Ultra Champion

The DMC shows us the following -

alt text

It shows the connected forwarders to the four indexers, the yellow line is actually two indexers one on top of the other.

How can we figure out which two hundred or so forwarders are not connected to the two newer indexers (the blue and purple) at the bottom of the chart?

Tags (2)
0 Karma

ddrillic
Ultra Champion

Jeff suggested -

-- You should be able to run a search on _internal for the last 24 hours looking for host whose count of splunk_server != 4.

0 Karma

rharrisssi
Path Finder

I know this isn't what you're asking, but having hundreds of forwarders going directly to your indexers is against best practice. The Heavy Forwarder role should be intercepting these messages from the UFs and such and then forwarding them to the indexers.

This also allows you to do some preprocessing with transforms and props that would otherwise take resources away from your indexers.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...