i have search head A and B and C. it is search head clustering structure. i modified $SPLUNK_HOME/etc/apps/custom_apps/lib/connect.py from search head C and restartss to search head C only. i think change and applied from search head C only. but, search head A and B together change and applied my questions mean I modified Search Head C directly without using deployer, but why does it work? and How does search head clustering refer to python files in this case? ... View more

Hi splunkers! how can i know(/find) the metric logs capture from pipeline? I want to find the heavy forwarder resource load.. i mean if index=_internal source=metrics.log group=*thruput* that is indexing pipeline capture. reference : https://docs.splunk.com/Documentation/Splunk/8.0.2/Troubleshooting/Aboutmetricslog but, index=_internal source=metrics.log group="tcpin_connections" i don't know that. can i know the parsing pipeline capture metric log groups? please help me. ps. I have referenced the site below. https://www.splunk.com/en_us/blog/tips-and-tricks/some-details-on-metrics-log-data-format-utility.html https://www.splunk.com/en_us/blog/tips-and-tricks/forwarder-and-indexer-metrics.html https://wiki.splunk.com/Deploy:Splunk_Metric_Reports https://www.splunk.com/en_us/blog/conf-splunklive/tracking-indexing-status-in-splunkd-log-and-metrics-log.html ... View more