Hi All, currently we are facing an issue, where one of the indexer is consuming more space compared to other indexers instance in our evironment and they all share the common indexes.conf, outputs.conf file and inputs.conf files. When checked in the forum, I was recommanded to add the below stanza to over come this issue in /local/outputs.conf file.
**forceTimeBasedAutoLB=true
autoLBFrequency = 15**
But before implementing the changes in prod, I wanted to validated any difference in time or lag in reaching these indexer instances.
I had executed the below search and getting **events but not sure what I need to check in the events**.
ex: index=_internal host=ourHWF splunk_server=splunk0* time frame (1 hrs)
Can anyone **provide me the exact search** on how to find out the **time difference between the indexer instances and heavy forwarder**?
thanks in advance.
↧