I have forwarders installed on two servers, but why do I only see log details returned for one host when running a search?

[imsiva]

Dear Team

I have two WAS servers (two nodes - server01 and server02) clustered. I have two forwarders in each of these nodes. So my splunk search is:

host="server0*" source="/var/apps/IBM/WASAppTarget0*/serverout.log"

When I search like this, only one host's log files is returned. For example I get the details of server01, but not server02. Ideally it should return both the server's log details.

Please advice.

[vasanthmss]

Hi imsiva,

First ensure two forwarders are sending data and the host names are different (as like you mentioned above).
then source file path is common(except the server name) in two forwarders.

search :

index=<your index> host=* 
index=<your index> host=server01 source="/var/apps/IBM/WASAppTarget0*/serverout.log"
index=<your index> host=server02 source="/var/apps/IBM/WASAppTarget0*/serverout.log"

If the above queries gives appropriate results then the below query will gives results as expected.

index=<your index>  host="server0*" source="/var/apps/IBM/WASAppTarget0*/serverout.log"

Cheers!