Splunk Search

Is there a search to check if the universal forwarder has enabled forceTimeBasedAutoLB?

kteng2024
Path Finder

I have enabled forceTimeBasedAutoLB on universal forwarder, but i want check whether that forwarder is making use of this change or not. So, is there any search or command to check that?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:

index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer 
| chart count over host by splunk_server limit=0

There should be a column for each indexer and the values should be more or less same.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:

index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer 
| chart count over host by splunk_server limit=0

There should be a column for each indexer and the values should be more or less same.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...