All,
I am looking for a daily PDF report that verifies none of the dropped events are outside of my retention policy for that index and gives me warning if an indexer might be over tasked. Any idea how I would get that going?
Hi,
In splunk monitoring console you can set "Saturated event-processing queues" alert to checked if indexer might be over tasked.
