Getting Data In
Highlighted

How to search a list of forwarders and what indexes they are sending data to?

New Member

How to search a list of forwarders sending data to a single index or multiple indexes?

ie: forwarder (A) sending to index (1) or index (2) or both indexes.

0 Karma
Highlighted

Re: How to search a list of forwarders and what indexes they are sending data to?

Path Finder

crude but quick

index=* | table host index | uniq | sort host

note index = * so will be intensive, limit time period appropriately

also index=* OR index=_* will give you all internal indexes if thats required

this will give you ALL hosts not just forwarders so you can add host=UF* OR host=HW* assuming host names of the forwarders are that to reduce your results

View solution in original post