How to search a list of forwarders sending data to a single index or multiple indexes?
ie: forwarder (A) sending to index (1) or index (2) or both indexes.
crude but quick
index=* | table host index | uniq | sort host
note index = * so will be intensive, limit time period appropriately
index = *
also index=* OR index=_* will give you all internal indexes if thats required
index=* OR index=_*
this will give you ALL hosts not just forwarders so you can add host=UF* OR host=HW* assuming host names of the forwarders are that to reduce your results
host=UF* OR host=HW*
View solution in original post