How to check if forwarders are sending data only to a specific indexer or not?

[kteng2024]

I have forwarder configured to send data to five indexers in their outputs.conf. But i see only one indexer queue is full. Is there anyway we can check whether the forwarders are sending data to specific indexer and leaving other indexers or sending data to all the indexers ?

[aaraneta_splunk]

@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

[somesoni2]

You can use following query to check the distribution of the data sent to indexers (field name splunk_server). select the appropriate time range.

| tstats count WHERE index=* host=YourForwarderNameHere by splunk_server 

[ddrillic]

Is it possible to run it for a set of forwarders?

[somesoni2]

Absolutely, either specify the host list like this, or use a subsearch to dynamically generate the list.

 | tstats count WHERE index=* host=forwarder1 OR host=forwarder2..... by splunk_server 

or

| tstats count WHERE index=*[| inputlookup somehostlookup.csv | table host ] by splunk_server 

[ddrillic]

Perfect as usual !!! thank you.

[TStrauch · Accepted solution]

Hi,

probably this post can help you.

https://answers.splunk.com/answers/62908/universal-forwarder-not-load-balancing-to-indexers.html

In addition you can check the configuration parameter "forceTimebasedAutoLB" this often get rid of such problems.

kind regards

[gokadroid]

Can you please check if this section is helpful to get you started on how to check data sent via forwarders:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Cantfinddata#Are_you_using_forward...

[kml_uvce]

there are multiple ways to know this
search directly in indexer in command line :

http://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CLIsearchsyntax