List/count no of all file my forwarder is monitoring

[robertlynch2020]

Hi

I have an environment that is increasing in files each day, this I think is causing high CPU on the forwarders as the number of files is increasing.

I am looking to prove this, so is there a command I can run on the forwarder that will tell me the number of files it is monitoring, etc... or something that will give me data on this topic?

Regards

Robert Lynch

[richgalloway · Accepted solution]

The command splunk list monitor will tell you which files a forwarder is monitoring, but not give a number (the shell can help with that) nor show how the list has changed over time.

Try this query in a search head, instead.

| tstats prestats=true dc(source) as files where index=* host=<forwarder-name> by _time
| timechart dc(source) as files