Splunk Search

How to check if forwarders are sending data only to a specific indexer or not?

kteng2024
Path Finder

I have forwarder configured to send data to five indexers in their outputs.conf. But i see only one indexer queue is full. Is there anyway we can check whether the forwarders are sending data to specific indexer and leaving other indexers or sending data to all the indexers ?

0 Karma
1 Solution

TStrauch
Communicator

Hi,

probably this post can help you.

https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

In addition you can check the configuration parameter "forceTimebasedAutoLB" this often get rid of such problems.

kind regards

View solution in original post

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can use following query to check the distribution of the data sent to indexers (field name splunk_server). select the appropriate time range.

| tstats count WHERE index=* host=YourForwarderNameHere by splunk_server 
0 Karma

ddrillic
Ultra Champion

Is it possible to run it for a set of forwarders?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Absolutely, either specify the host list like this, or use a subsearch to dynamically generate the list.

 | tstats count WHERE index=* host=forwarder1 OR host=forwarder2..... by splunk_server 

or

| tstats count WHERE index=*[| inputlookup somehostlookup.csv | table host ] by splunk_server 

ddrillic
Ultra Champion

Perfect as usual !!! thank you.

0 Karma

TStrauch
Communicator

Hi,

probably this post can help you.

https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

In addition you can check the configuration parameter "forceTimebasedAutoLB" this often get rid of such problems.

kind regards

0 Karma

gokadroid
Motivator

Can you please check if this section is helpful to get you started on how to check data sent via forwarders:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forward...

0 Karma

kml_uvce
Builder

there are multiple ways to know this
search directly in indexer in command line :

http://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CLIsearchsyntax

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...