Is there a search to check if the universal forwarder has enabled forceTimeBasedAutoLB?

[kteng2024]

I have enabled forceTimeBasedAutoLB on universal forwarder, but i want check whether that forwarder is making use of this change or not. So, is there any search or command to check that?

[somesoni2 · Accepted solution]

You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:

index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer 
| chart count over host by splunk_server limit=0

There should be a column for each indexer and the values should be more or less same.