topic Re: Data calculate from heavy forwarders and intermediate forwarders to indexer cluster in Getting Data In

Data calculate from heavy forwarders and intermediate forwarders to indexer cluster

Mani2 — Mon, 03 Feb 2025 15:08:56 GMT

Hi,

I wanted to check that how can I get total data transfer from on-prem heavy forwarders and intermediate forwarders to cloud indexer cluster? is there a search which can look into splunkd.log or metrics.log from heavy forwarder for data transferred for 24 hours...

Re: Data calculate from heavy forwarders and intermediate forwarders to indexer cluster

richgalloway — Mon, 03 Feb 2025 15:34:03 GMT

Perhaps this will help

index=_internal host=<<forwarder name>> component=Metrics name=thruput earliest=-24h | stats sum(total_k_processed) as "total data transfer"

Re: Data calculate from heavy forwarders and intermediate forwarders to indexer cluster

Mani2 — Mon, 03 Feb 2025 15:42:19 GMT

Thanks Rich, that helps.
How can I get it in MB or GB as it is tough to read "91345084304594.000"

Re: Data calculate from heavy forwarders and intermediate forwarders to indexer cluster

Mani2 — Mon, 03 Feb 2025 15:47:57 GMT

Sorry missed to ask,

And how can I see same in this search result for multiple hosts ?

Re: Data calculate from heavy forwarders and intermediate forwarders to indexer cluster

richgalloway — Mon, 03 Feb 2025 16:18:22 GMT

Easy-peasy

index=_internal host=* component=Metrics name=thruput earliest=-24h | stats sum(total_k_processed) as "total data transfer" by host ```Convert KB to GB``` | eval "total data transfer" = 'total data transfer'/1024/1024