Splunk Search

Is there a search to check if the universal forwarder has enabled forceTimeBasedAutoLB?

kteng2024
Path Finder

I have enabled forceTimeBasedAutoLB on universal forwarder, but i want check whether that forwarder is making use of this change or not. So, is there any search or command to check that?

0 Karma
1 Solution

somesoni2
Revered Legend

You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:

index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer 
| chart count over host by splunk_server limit=0

There should be a column for each indexer and the values should be more or less same.

View solution in original post

somesoni2
Revered Legend

You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:

index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer 
| chart count over host by splunk_server limit=0

There should be a column for each indexer and the values should be more or less same.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...