Hi ,
I installed a heavy forwarder for regex processing a few source types, not for indexing. How can I know whether the heavy forwarder is processing the regex? How can I check the memory consumption and CPU consumption from the search head or DMC (heavy forwarder is connected to DMC)?
Regex processing:
1) If regex is correct , you should see extracted field in interesting fields for that sourcetype by using spl query.
2) from GUI, settings->fields-> field extractions-> search for sourcetype or field name. it should fetch some results
CPU and Memory:
1) Install Splunk_TA_nix splunk Addon. So it will report cpu, memory and other os related stats.
2) Settings->Montoring Console-> Resource Usage-> Resource usage:Instances-> select the instance - for this you need setup montoring console