How to search a list of forwarders and what indexes they are sending data to?

[patrickcope]

How to search a list of forwarders sending data to a single index or multiple indexes?

ie: forwarder (A) sending to index (1) or index (2) or both indexes.

[0YAoNnmRmKDg · Accepted solution]

crude but quick

index=* | table host index | uniq | sort host

note index = * so will be intensive, limit time period appropriately

also index=* OR index=_* will give you all internal indexes if thats required

this will give you ALL hosts not just forwarders so you can add host=UF* OR host=HW* assuming host names of the forwarders are that to reduce your results