Here is the Guide you need : https://docs.splunk.com/Documentation/Splunk/8.0.5/InheritedDeployment/Introduction Now you can figure much by just looking at the internal logs. indexers : look at the splunk_server field, it tells you on which indexer the data is stored. index=_internal | stats dc(host) count by splunk_server heavy forwarders / forwarders : look at the metrics logs, and identify who it sending data to who , and look at the fwdType field. index=_internal source=*metrics.log* group=tcpin_connections fwdType=*
| stats dc(hostname) values(version) values(os) by fwdType
... View more
