I have forwarder configured to send data to five indexers in their outputs.conf. But i see only one indexer queue is full. Is there anyway we can check whether the forwarders are sending data to specific indexer and leaving other indexers or sending data to all the indexers ?
Hi,
probably this post can help you.
https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html
In addition you can check the configuration parameter "forceTimebasedAutoLB" this often get rid of such problems.
kind regards
@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!
You can use following query to check the distribution of the data sent to indexers (field name splunk_server). select the appropriate time range.
| tstats count WHERE index=* host=YourForwarderNameHere by splunk_server
Is it possible to run it for a set of forwarders?
Absolutely, either specify the host list like this, or use a subsearch to dynamically generate the list.
| tstats count WHERE index=* host=forwarder1 OR host=forwarder2..... by splunk_server
or
| tstats count WHERE index=*[| inputlookup somehostlookup.csv | table host ] by splunk_server
Perfect as usual !!! thank you.
Hi,
probably this post can help you.
https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html
In addition you can check the configuration parameter "forceTimebasedAutoLB" this often get rid of such problems.
kind regards
Can you please check if this section is helpful to get you started on how to check data sent via forwarders:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forward...
there are multiple ways to know this
search directly in indexer in command line :
http://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CLIsearchsyntax