Splunk Search

How to check if forwarders are sending data only to a specific indexer or not?

Path Finder

I have forwarder configured to send data to five indexers in their outputs.conf. But i see only one indexer queue is full. Is there anyway we can check whether the forwarders are sending data to specific indexer and leaving other indexers or sending data to all the indexers ?

0 Karma
1 Solution

Communicator

Hi,

probably this post can help you.

https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

In addition you can check the configuration parameter "forceTimebasedAutoLB" this often get rid of such problems.

kind regards

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

0 Karma

SplunkTrust
SplunkTrust

You can use following query to check the distribution of the data sent to indexers (field name splunk_server). select the appropriate time range.

| tstats count WHERE index=* host=YourForwarderNameHere by splunk_server 
0 Karma

Ultra Champion

Is it possible to run it for a set of forwarders?

0 Karma

SplunkTrust
SplunkTrust

Absolutely, either specify the host list like this, or use a subsearch to dynamically generate the list.

 | tstats count WHERE index=* host=forwarder1 OR host=forwarder2..... by splunk_server 

or

| tstats count WHERE index=*[| inputlookup somehostlookup.csv | table host ] by splunk_server 

Ultra Champion

Perfect as usual !!! thank you.

0 Karma

Communicator

Hi,

probably this post can help you.

https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

In addition you can check the configuration parameter "forceTimebasedAutoLB" this often get rid of such problems.

kind regards

View solution in original post

0 Karma

Motivator

Can you please check if this section is helpful to get you started on how to check data sent via forwarders:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forward...

0 Karma

Builder

there are multiple ways to know this
search directly in indexer in command line :

http://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CLIsearchsyntax

0 Karma