Splunk search for Indexers a Univeral Forwarder is Sending Data To

Copy


			index=_internal tcpouteloop "connected to idx" | stats count by idx

This search will show you all indexers that your Splunk Universal Forwarders are successfully sending logs to. Useful for troubleshooting data flow and determining where your data is going.

0 comments

[0]

Category:

Universal Forwarder

Tags:

universal forwarder troubleshooting forwarding data flow networking Admin

Search Commands: