Sourcetype by Forwarder GUID

[mwdbhyat]

Hi there,

I have 2 forwarders on a single box - one HF one UF. I want to switch off the UF. Im looking for a list of sourcetypes that the UF is sending. Does anyone have a search that can tell me what sourcetypes are actively sending data to Splunk via the UF's GUID ?

Thanks! 

[isoutamo]

Have both forwarders the sane server name on server.conf?
If yes is it option to use different?

[mwdbhyat]

They both use the same - right now no option to change. I know i can use btool and list monitor to get a list of inputs.. but was hoping there was a way of generating a more "active" result from search. 

[isoutamo]

You could get some info from metrics.log on those nodes. It tells 10 top source, sourcetypes etc. at time. Just switch those to the HF and wait some time to look next round. Probably you could found same information from indexer side also with GUID, but probably it’s easier to check with Greg etc from command line.