I would like to monitor forwarder indexing performance via S.O.S. The _internal already forwarded to indexer and could be searched as "index=_internal host=fwd" on indexer. But I could not find it on the dropbox "Server to query" in S.O.S. Overview or any other dashboard.
Do I need to modify anything or any steps I did wrong?
/!\ THE FOLLOWING INSTRUCTIONS ARE ONLY VALID FOR SOS 2.2 AND NEWER /!\
In SoS 2.2, the "Server to query" pulldown present in most views and that lists instances reachable by distributed search will load from a lookup file "splunk_servers_cache.csv", refreshed at 5-minute intervals.
This will considerably speed up the population of this omnipresent pulldown. It also means that you'll be able to scope S.o.S' views to events in the _internal index (or in other indexes, by updating the appropriate macros such as
In order to do this, you will have to manually append an entry to the "splunk_servers_cache.csv" lookup. The fields required for an entry are:
Step by step instructions:
1 - Install the SoS technology add-on for Unix and Linux on the forwarder whose resource usage you care to monitor.
3 - Verify that the forwarder is now sending events generated by the
The hostname of your forwarder should be among the values returned.
4 - Append a new line to the
Here's an example of the kind of line you would append to
5 - The "Server to query" pulldown in the "Splunk CPU/Memory Resource Usage" view should now list your forwarder and enable you to view its system resource usage.