We’ve been ardently listening to your posts, emails, and requests around improved controls and visibility into forwarders, indexers, and overall connectivity of these Splunk resources. So, just before the Thanksgiving holiday the Splunk crew posted a new application to SplunkBase. The Splunk Enterprise Manager application reaches into the internal logs and pulls interesting artifacts from the Splunk infrastructure, especially around forwarder and indexer connectivity and data volume analysis. You’ll like the visibility into the top ten forwarders by volume, indexer volumes, views by sourcetype, forwarders down in the last 24 hours, and on and on. Best of all, the app provides improved visibility to your Splunk enterprise infrastructure. Of course, we ran this application in our own environment to fine tune the reports and dashboards. Take a look and let us know what you think and go ahead and vote on it!
Docs: Splunk Wiki
By Tom Donahoe