I all as an architect sometimes I find myself in environment where the inputs are misconfigured and splunk servers are receiving traffic directly. For example the search head and indexer receiving traffic directly even if a syslog server/HF is present in the environment. Is there a search with which I can find out each source type and which Splunk  server is receiving the logs and forwarding it to the indexer layer. This will really help in resolving issues. Thanks   ... View more

Hello All, We created a custom search on splunk which calculates a specific metric on all the servers that are part of the distributed search. I wanted to find out if its possible to run this custom search on splunk servers which are not part of the distributed search via GUI or CLI. when I try running  /opt/splunk/bin/splunk search 'customsearchcommand inputs' -uri https://172.31.2.100:8089 (172.31.2.100 is not part of the distributed search) it says customsearchcommand not found. The custom search command is only present on the search head and it is working perfectly on all the distributed search peers without having the custom search defined there.    Thanks ... View more