How can i find only SH replication errors ?

Deployment Architecture

I'm currently running Splunk 6.5.3

I want to create a KPI based on search heads replication errors.

I found this search :

index="_internal" sourcetype=splunkd replicate log_level=ERROR component=SHCRepJob

I can see search heads on host fields but it seem to be too much result.

Have a better idea ?

How can i find all replications errors (lookup, etc ..) ?

1 KB

Get Updates on the Splunk Community!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with another ...

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...