Getting Data In

Identifying forwarders from indexer

glenngermiathen
Path Finder

With almost no experience I recently was appointed as Splunk admin when the previous one quit. There is no documentation on how the system is set up so the first thing I am trying to do is get an idea of how everything works together. I am working with Ubuntu indexers and a windows search head. How can I tell which systems are forwarding to the indexers, and where is the config for archiving located on the indexer? Any other help is greatly appreciated too.

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The easiest way for a novice to get a first glimpse into your forwarders is to take a look at the "All Forwarders" view in the Deployment Monitor app. If your installation does not already have it you can get it here: http://splunk-base.splunk.com/apps/67836/splunk-deployment-monitor / http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor-4x

glenngermiathen
Path Finder

Using the app now it is a big help.

0 Karma

kristian_kolb
Ultra Champion

You could install the Splunk Deployment Monitor app, unless you already have it installed. It will show you some metrics, and the general health of your forwarders.

Not a lot of time for knowledge transfer?

bmacias84
Champion

Every instance of Splunk can potentially be a forwarder and full instances can be search head, indexer, Forwarder, Deployment server, and licensing server. From the search head in manage look for who are its search peers which should tell you who are indexers. Indexer settings are located in index.conf but index.conf can be located in apps and under system.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...