topic Re: Need Linux equivalent query for network traffic stats in All Apps and Add-ons

Need Linux equivalent query for network traffic stats

NK — Wed, 21 Aug 2024 23:58:36 GMT

Using Splunk Add-on for Microsoft Windows, Splunk Add-on for Unix and Linux on Splunk Enterprise v9.3.0

What are the Linux (RHEL 8 ) equivalents for these Splunk Windows queries?

e.g. Network Traffic:

Windows:

index=wmi host=MyWindowsHost sourcetype="Perfmon:Network Interface" counter=Bytes* | timechart span=15m max(Value) as "Bytes/sec" by counter

Linux:
?

e.g. CPU:

Windows:

index=wmi host=MyWindowsHost sourcetype="Perfmon:CPU Load" | timechart span=15m max(Value) as "CPU Load" by counter

Linux:

index=os host=MyLinuxHost source=cpu CPU="all" | timechart span=15m max(pctSystem),max(pctUser) by CPU

Re: Need Linux equivalent query for network traffic stats

gcusello — Wed, 21 Aug 2024 06:27:50 GMT

Hi @NK ,

I suppose that you're using the Splunk_TA_nix add-on to ingest the Linux logs, if not, use it!

You have to enable the [script://./bin/netstat.sh] input.

In this way, you'll have the same information of Windows.

Ciao.

Giuseppe

Re: Need Linux equivalent query for network traffic stats

NK — Wed, 21 Aug 2024 23:12:55 GMT

I enabled netstsat in $SPLUNK_HOME/etc/apps/Splunk_TA_nix/local/inputs.conf
I see Send_Q and Recv_Q (from "netstat -a"?) , but those look like the corresponding queue sizes in bytes.
I think the Windows/wmi equivalent reports traffic (bytes/sec) through the network adapter.

Re: Need Linux equivalent query for network traffic stats

gcusello — Thu, 22 Aug 2024 05:49:41 GMT

Hi @NK ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉