How to search a list of forwarders sending data to a single index or multiple indexes?
ie: forwarder (A) sending to index (1) or index (2) or both indexes.
crude but quick
index=* | table host index | uniq | sort host
note index = *
so will be intensive, limit time period appropriately
also index=* OR index=_*
will give you all internal indexes if thats required
this will give you ALL hosts not just forwarders so you can add host=UF* OR host=HW*
assuming host names of the forwarders are that to reduce your results
crude but quick
index=* | table host index | uniq | sort host
note index = *
so will be intensive, limit time period appropriately
also index=* OR index=_*
will give you all internal indexes if thats required
this will give you ALL hosts not just forwarders so you can add host=UF* OR host=HW*
assuming host names of the forwarders are that to reduce your results