I should have described my setup a little better, as don't believe that I can use a test index. My setup is a number of servers sending to a single forwarder which forwards to storm. I am doing tests on the servers that will roughly simulate a load base (which would get multiplied by number of users).
From what I understand, the test index requires splunk instances that forward to the UF which gets forwarded to the target instance.
My current plan is to write a test application that sends a large number of messages to the forwarder, but I don't know how to measure if the forwarder is overloaded. Would the fishbucket work for that?
Thanks,
Erick
... View more