I have enabled forceTimeBasedAutoLB on universal forwarder, but i want check whether that forwarder is making use of this change or not. So, is there any search or command to check that?
You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:
index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer
| chart count over host by splunk_server limit=0
There should be a column for each indexer and the values should be more or less same.
You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:
index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer
| chart count over host by splunk_server limit=0
There should be a column for each indexer and the values should be more or less same.