SPLUNK architecture

[Jeronimo317]

Hi, I am very new to SPLUNK and inherited an environment without much documentation. Can anyone help with the following queries. 

1. List of all UF hosts and the HF each of them forwards to
2. List of all HF and the Indexer each of them forwards to
3. List of all indexers  

Thank you .

[yannK]

Here is the Guide you need :

https://docs.splunk.com/Documentation/Splunk/8.0.5/InheritedDeployment/Introduction

Now you can figure much by just looking at the internal logs.

indexers : look at the splunk_server field, it tells you on which indexer the data is stored.

index=_internal | stats dc(host) count by splunk_server

heavy forwarders / forwarders : look at the metrics logs, and identify who it sending data to who , and look at the fwdType field.

index=_internal source=*metrics.log* group=tcpin_connections fwdType=*
| stats dc(hostname) values(version) values(os) by fwdType