Splunk Search

Is there a search to check if the universal forwarder has enabled forceTimeBasedAutoLB?

Path Finder

I have enabled forceTimeBasedAutoLB on universal forwarder, but i want check whether that forwarder is making use of this change or not. So, is there any search or command to check that?

0 Karma
1 Solution

Revered Legend

You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:

index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer 
| chart count over host by splunk_server limit=0

There should be a column for each indexer and the values should be more or less same.

View solution in original post

Revered Legend

You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:

index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer 
| chart count over host by splunk_server limit=0

There should be a column for each indexer and the values should be more or less same.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!