How to determine which indexer received an event and how to output a graph with count by indexer?

[ateterine]

Hi Splunkers,

I am sure I've seen this before, but cannot remember.

In the cluster of 3 indexers and replication factor of 3 I am trying to determine which indexer receives an event, which field can I use to indicate that?

Essentially I would like to output a graph with count by indexer/host etc.

Thank you!

[xpac]

Hey,

by default, you can't. There is a field splunk_server, but it only shows which indexer returned that event and might be different in every search, because a different indexer might return a different subset of the result.
If you really want to know which indexer received an event, i.e. parsed and processed it, you could add an config for an index-time field on every indexer and set that field to that indexer's name. However, this only works for newly indexed data and might slightly increase disk space used.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

[ateterine]

Thanks @xpac is there a way to get this info from DMC?