I am forwarding some logs from a Heavy Forwarder to 2 indexers. I want to check if forwarder is balancing load/distributing events properly or not ?
**OUTPUTS.CONF**
[indexAndForward]
index = false
[tcpout]
defaultGroup = G1
forwardedindex.filter.disable = true
[tcpout:G1]
disabled = 0
server = IP_Addr_Indexer1:9997,IP_Addr_Indexer2:9997
useACK=true
forceTimebasedAutoLB = true
autoLB = true
**INPUTS.CONF**
[monitor:///var/log/Folder1/Folder2]
host_segment=5
index=SomeIndex
sourcetype=SomeSourcetype
disabled=0
Like out of 100 events, say 40 events are going to indexer 1 and the rest 60 going to indexer 2. How can I check it ?
↧