@AShwin1119 Did you went through the response and have any further questions? ... View more

You already asked a question about this issue. Please read the answers you got there. ... View more

Hi when you have a distributed environment it’s mandatory that all servers send their internal logs into indexer cluster as @VatsalJagani already pointed! Without that it’s really hard to debug and monitoring this environment. You should also have MC and LM setting up in some node. Best to have own instance for those or use e.g. SH deployer for those. There are list of combinations which are allowed and supported by splunk in doc.splunk.com. r. Ismo ... View more

@AShwin1119- I think its the same question here I have answered - https://community.splunk.com/t5/Monitoring-Splunk/indexer-cluster-to-SH-cluster-replication-issue/m-p/709746/highlight/true#M10687   I think you are not forwarding the SH data to Indexers. * Which is compulsory when you are using SHC. * And best-practice in all SHs. https://docs.splunk.com/Documentation/Splunk/9.4.0/DistSearch/Forwardsearchheaddata   I hope this helps!!! Kindly upvote if it does!!!! ... View more

Hi @AShwin1119, did you explored the values option in stats command? | stats values(Date_Policy) AS Date_Policy values(host) AS host BY Volume WeekRange Ciao. Giuseppe ... View more

Do you get the data via the vcenter API that you're calling or via syslog? If you're pulling the data check the internal log source hydra_worker_ta_vmware_collection_worker_*.log for error messages. ... View more

What does the following search tell you when you run it for the log source under question? The host value should give you the name of the HF. index=<your_index> sourcetype="your_sourcetype" | dedup host | table host   If this doesn't give you the desired result, then try the following (Ignore the name of the indexers in the search and focus on the others. You'll find the name of the HF): index=_internal "sourcetype_name" | dedup host | table host  ++If this helps, please consider accepting as an answer++ ... View more

Hi Can you told how you try to collect it and where? Are you using a splunk app from splunkbase or your own? Have you a distributed environment? Which versions you are using UF, Splunk server, Linux distro + version etc. r. Ismo ... View more