Splunk Search

Is there a search to check if the universal forwarder has enabled forceTimeBasedAutoLB?

kteng2024
Path Finder

I have enabled forceTimeBasedAutoLB on universal forwarder, but i want check whether that forwarder is making use of this change or not. So, is there any search or command to check that?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:

index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer 
| chart count over host by splunk_server limit=0

There should be a column for each indexer and the values should be more or less same.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You can check if the events from that host are (almost) evenly distributed to all indexers. Something on the line of:

index=yourindex (add more OR index=A OR index=B.. in case there are multiple indexes the host sends data to )
host=yourUFServer 
| chart count over host by splunk_server limit=0

There should be a column for each indexer and the values should be more or less same.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...