splunk indexer

[verifi81]

What is a way I can confirm that a splunk server is doing INDEXING?

[richgalloway]

One way is to check splunkd.log to see if the server reports itself as an indexer.

grep "Declared role" /opt/splunk/var/log/splunk/splunkd.log

 Another way is to see if the server is writing any hot buckets.  The _internal index is the best way to check.

ls -l $SPLUNK_DB/_internaldb/db/hot*

[verifi81]

Is there a way to confirm within the UI? 

I did grep the splunkd.log for "declared role" but nothing came up.   

[isoutamo]

Both can queried from internal index.

index=_internal host=<your host> source=*splunkd.log sourcetype=splunkd “declare role” and time frame enough long to find that entry. And same for buckets. 

r. Ismo