forwarder

[SN1]

Hello I have a index name msad and i want to know which forwarder is sending data to this index . And also the data it is sending is stored where like from where this forwarder is sending this data.

[PickleRick]

The general answer to questions like "how to find which hosts send to which indexes" is "you can't do that reliably". There are some things you can do to find info in some specific situations but they will not cover all possible scenarios.

1. As @livehybrid already pointed out, you can try browsing through forwarders' metrics. There are two caveats here:

- the metrics are limited to a fixed number of top data points so if your forwarder is sending to a huge number of different indexes you might not see that

- events can be rerouted on HFs/indexers to different indexes that they were initially destined for

2. You can simply check the host field. But this is very unreliable technique and only works if you're capturing the events localy with the forwarder and not override the host in any way.

3. You can configure your environment (but this needs to be beforehand) so that forwarders add metadata to events by means of additional indexed fields or - for some types of sources - source field. This might get complicated and difficult to maintain if you don't use orchestration tools. And might have limitations if you're using multi-hop ingestion paths.

[livehybrid]

Hi @SN1 

You can modify the search below to use the metrics.log to get this information, update the series= value with the index name you want to look at, and you may also want to exclude your indexer(s) as these also collect the metrics on index thruput

index=_internal series=YourIndex group=per_index_thruput host!=YourIndexer* 
|  eval gb=kb/1024/1024
|  timechart sum(gb) AS gb by host 

This will give a chart showing the GB of data for each forwarder.

livehybrid_0-1738748815198.png

Please let me know how you get on and consider upvoting/karma this answer if it has helped.
Regards

Will