Identifying forwarders from indexer

[glenngermiathen]

With almost no experience I recently was appointed as Splunk admin when the previous one quit. There is no documentation on how the system is set up so the first thing I am trying to do is get an idea of how everything works together. I am working with Ubuntu indexers and a windows search head. How can I tell which systems are forwarding to the indexers, and where is the config for archiving located on the indexer? Any other help is greatly appreciated too.

[martin_mueller]

The easiest way for a novice to get a first glimpse into your forwarders is to take a look at the "All Forwarders" view in the Deployment Monitor app. If your installation does not already have it you can get it here: http://splunk-base.splunk.com/apps/67836/splunk-deployment-monitor / http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor-4x

[glenngermiathen]

Using the app now it is a big help.

[kristian_kolb]

You could install the Splunk Deployment Monitor app, unless you already have it installed. It will show you some metrics, and the general health of your forwarders.

Not a lot of time for knowledge transfer?

[bmacias84]

Every instance of Splunk can potentially be a forwarder and full instances can be search head, indexer, Forwarder, Deployment server, and licensing server. From the search head in manage look for who are its search peers which should tell you who are indexers. Indexer settings are located in index.conf but index.conf can be located in apps and under system.