Well, there is generally quite a lot going on in your forwarders and not all of it is good. But it seems that both of those forwarders connect to the indexer. 03-24-2022 10:46:30.907 -0500 INFO TcpOutputProc - Found currently active indexer. Connected to idx=10.21.20.29:9997, reuse=1. You can verify from which hosts the events in _internal index come from. | tstats count where index=_internal by host You should get values for both of your forwarders (as well as another parts of your splunk infrastructure). It's hard however to tell what else is going on in your setup since it clearly has some issues. ... View more