How to determine if forwarder weight distribution is good from search?

[mhouse]

I need help figuring something out.

Got this search during .conf19 to be used to do a Forwarder weight distribution search:

index=_internal Metrics sourcetype=splunkd TERM(group=tcpin_connections) earliest=-4hr latest=now [|dbinspect index=_* 
|stats values(splunk_server) as indexer 
|eval search="host IN (".mvjoin(mvfilter(indexer!=""),",").")"] 
|stats sum(kb) as throughput by hostname 
|sort - throughput 
|eventstats sum(throughput) as total_throughput dc(hostname) as all_forwarders 
|streamstats sum(throughput) as accumlated_throughput count by all_forwarders 
|eval coverage=accumlated_throughput/total_throughput, progress_through_forwarders=count/all_forwarders 
|bin progress_through_forwarders bins=100 
|stats max(coverage) as coverage by progress_through_forwarders all_forwarders 
|fields progress_through_forwarders coverage

How do I interpret the results from this search? If the numerical representation of coverage is within 0.1 across all results is that success? Across 100 results, the coverage values range from 0.82594059014 to 1.0000000.

[codebuilder]

If you are using indexer discovery, then the monitoring console on the master will provide a tremendous amount of information regarding your forwarders. Including status, thruput, distribution, and much more.

[gcusello]

Hi mhouse,
did you already explored the Management Console?
probably there's that you're searching: I used it for a customer some months ago.

Ciao.
Giuseppe

[mhouse]

I don't understand your question. I ran my query on the SH and I am seeking help in understanding the results.