https://community.splunk.com/t5/Getting-Data-In/forwarder-and-indexing-volume/m-p/129690#M26628 <P>Hello friends!</P> <P>Today there are very strange behavior on splunk server.</P> <P>On the average Volume used today = 50-120MB<BR /> But today i has some crazy numbers = 2,936 MB, but number of events in the database about the same from day to day.</P> <P>Prompt how can I trace with any of forwarders is so much traffic?</P> <P>Thank you!</P> Thu, 03 Jul 2014 12:53:05 GMT templier 2014-07-03T12:53:05Z https://community.splunk.com/t5/Getting-Data-In/forwarder-and-indexing-volume/m-p/129690#M26628 <P>Hello friends!</P> <P>Today there are very strange behavior on splunk server.</P> <P>On the average Volume used today = 50-120MB<BR /> But today i has some crazy numbers = 2,936 MB, but number of events in the database about the same from day to day.</P> <P>Prompt how can I trace with any of forwarders is so much traffic?</P> <P>Thank you!</P> Thu, 03 Jul 2014 12:53:05 GMT https://community.splunk.com/t5/Getting-Data-In/forwarder-and-indexing-volume/m-p/129690#M26628 templier 2014-07-03T12:53:05Z https://community.splunk.com/t5/Getting-Data-In/forwarder-and-indexing-volume/m-p/129691#M26629 <P>You could check the metrics logs.</P> <PRE><CODE>index=_internal source=*metrics.log group=per_host_thruput | eval MB=kb/1024 | stats sum(MB) by series </CODE></PRE> Thu, 03 Jul 2014 14:57:29 GMT https://community.splunk.com/t5/Getting-Data-In/forwarder-and-indexing-volume/m-p/129691#M26629 Ayn 2014-07-03T14:57:29Z