https://community.splunk.com/t5/Getting-Data-In/Determine-The-Amount-Of-Data-Forwarded-By-Splunk-Forwarder-Over/m-p/101570#M21297 <P>Yes, install Deployment Monitor app on Splunk Indexer and you will have access to really useful information/charts/dashboards about all your splunk instances including what you're looking for and more. If you are on Splunk 4.2.3 or later you just have to enable it (as it comes with it).<BR /> Otherwise use this link to get it: <A href="http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor">http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor</A></P> <P>Hope this helps</P> <P><CODE>&gt; please upvote and accept answer if you find it useful - thanks!</CODE></P> Tue, 01 Nov 2011 03:15:08 GMT _d_ 2011-11-01T03:15:08Z https://community.splunk.com/t5/Getting-Data-In/Determine-The-Amount-Of-Data-Forwarded-By-Splunk-Forwarder-Over/m-p/101569#M21296 <P>Want to know if there is an easy way to check the amount of data a Splunk Forwarder on a box has forwarded to an Indexer over some period of time? Is this data logged somewhere? Is there a Splunk search I can do w/ a 'host' attribute and determine the amount of raw data collected over the search period? Thanks!</P> Tue, 01 Nov 2011 03:10:18 GMT https://community.splunk.com/t5/Getting-Data-In/Determine-The-Amount-Of-Data-Forwarded-By-Splunk-Forwarder-Over/m-p/101569#M21296 tehmasp 2011-11-01T03:10:18Z https://community.splunk.com/t5/Getting-Data-In/Determine-The-Amount-Of-Data-Forwarded-By-Splunk-Forwarder-Over/m-p/101570#M21297 <P>Yes, install Deployment Monitor app on Splunk Indexer and you will have access to really useful information/charts/dashboards about all your splunk instances including what you're looking for and more. If you are on Splunk 4.2.3 or later you just have to enable it (as it comes with it).<BR /> Otherwise use this link to get it: <A href="http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor">http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor</A></P> <P>Hope this helps</P> <P><CODE>&gt; please upvote and accept answer if you find it useful - thanks!</CODE></P> Tue, 01 Nov 2011 03:15:08 GMT https://community.splunk.com/t5/Getting-Data-In/Determine-The-Amount-Of-Data-Forwarded-By-Splunk-Forwarder-Over/m-p/101570#M21297 _d_ 2011-11-01T03:15:08Z https://community.splunk.com/t5/Getting-Data-In/Determine-The-Amount-Of-Data-Forwarded-By-Splunk-Forwarder-Over/m-p/101571#M21298 <P>Ah, right. I have this installed but don't use it nearly often. Thanks!</P> <P>My reason for asking was to get a better idea of the amount of data forwarded by certain classes of forwarders in our environment as to better set the MaxQueueSize in outputs.conf in the event of Indexer failure.</P> Tue, 01 Nov 2011 03:19:16 GMT https://community.splunk.com/t5/Getting-Data-In/Determine-The-Amount-Of-Data-Forwarded-By-Splunk-Forwarder-Over/m-p/101571#M21298 tehmasp 2011-11-01T03:19:16Z https://community.splunk.com/t5/Getting-Data-In/Determine-The-Amount-Of-Data-Forwarded-By-Splunk-Forwarder-Over/m-p/101572#M21299 <P>No problems. Please consider upvoting and accepting the answer so that other members can benefit from it. Thanks.</P> Tue, 01 Nov 2011 03:21:31 GMT https://community.splunk.com/t5/Getting-Data-In/Determine-The-Amount-Of-Data-Forwarded-By-Splunk-Forwarder-Over/m-p/101572#M21299 _d_ 2011-11-01T03:21:31Z