How can i find only SH replication errors ?

Deployment Architecture

I'm currently running Splunk 6.5.3

I want to create a KPI based on search heads replication errors.

I found this search :

index="_internal" sourcetype=splunkd replicate log_level=ERROR component=SHCRepJob

I can see search heads on host fields but it seem to be too much result.

Have a better idea ?

How can i find all replications errors (lookup, etc ..) ?

1 KB

Get Updates on the Splunk Community!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...