Hi @AndySplunks , I’m a Community Moderator in the Splunk Community. This question was posted 9 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

Interesting command. Everything is working as it should, but when I run it I get this; /opt/splunkforwarder/bin/splunk list forward-server Active forwards: None Configured but inactive forwards: sljplgf01.jostens.com:9997 sljplgf02.jostens.com:9997 My data travels from UF on the host, to intermediate forwarder to Indexer. The sljplgf0* servers are intermediate. Are these only active when transmitting data? Again, I'm getting fresh data from the host regularly now. ... View more

This was a physical system that had been repurposed to a degree.I bet you're right. ... View more

Got it. I was coming to the same conclusion reading the docs, thanks d ... View more

And of course that was it. Thanks! index="_internal" source="*metrics.log" group="per_host_thruput" | eval gb=((kb/1024)/1024) | chart sum(kb) by series date_month | lookup host_tags host as series | sort + series ... View more

Take a look at the license_usage.log on your license master. From the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Troubleshooting/WhatSplunklogsaboutitself license_usage.log Indexed volume in bytes per pool, index, source, sourcetype, and host. Starting in 4.2, license_usage.log is available only on a Splunk license master. ... View more