Apart from seeing data coming from the forwarders arriving in an index is there any way I can see which indexer a forwarder is currently sending data to? Either via a command, api call or log entry?
On a forwarder that isn't using indexer discovery you can do a "splunk list forward-server" you can also see a "Connected to " message in splunkd.log.
With indexer discovery neither of these show up the same.
↧