Getting Data In

How to check if Heavy Forwarder is autoload balancing properly ?

abhinav_maxonic
Path Finder

I am forwarding some logs from a Heavy Forwarder to 2 indexers. I want to check if forwarder is balancing load/distributing events properly or not ?

OUTPUTS.CONF

[indexAndForward]
index = false

[tcpout]
defaultGroup = G1
forwardedindex.filter.disable = true

[tcpout:G1]
disabled = 0
server = IP_Addr_Indexer1:9997,IP_Addr_Indexer2:9997
useACK=true
forceTimebasedAutoLB = true
autoLB = true

INPUTS.CONF

[monitor:///var/log/Folder1/Folder2]
 host_segment=5
 index=SomeIndex
 sourcetype=SomeSourcetype
 disabled=0

Like out of 100 events, say 40 events are going to indexer 1 and the rest 60 going to indexer 2. How can I check it ?

0 Karma

dineshraj9
Builder

Run the query to check -

index=SomeIndex  sourcetype=SomeSourcetype | timechart count by splunk_server
0 Karma

abhinav_maxonic
Path Finder

On which machine should I run this query - Indexer or SH ? And what should be the output of this query ?

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...