Getting Data In

How to search a list of forwarders and what indexes they are sending data to?

New Member

How to search a list of forwarders sending data to a single index or multiple indexes?

ie: forwarder (A) sending to index (1) or index (2) or both indexes.

0 Karma
1 Solution

Path Finder

crude but quick

index=* | table host index | uniq | sort host

note index = * so will be intensive, limit time period appropriately

also index=* OR index=_* will give you all internal indexes if thats required

this will give you ALL hosts not just forwarders so you can add host=UF* OR host=HW* assuming host names of the forwarders are that to reduce your results

View solution in original post

Path Finder

crude but quick

index=* | table host index | uniq | sort host

note index = * so will be intensive, limit time period appropriately

also index=* OR index=_* will give you all internal indexes if thats required

this will give you ALL hosts not just forwarders so you can add host=UF* OR host=HW* assuming host names of the forwarders are that to reduce your results

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!