topic Re: Network Monitoring between Enterprise Security Search Head and Indexers in Getting Data In

Network Monitoring between Enterprise Security Search Head and Indexers

shedalkar — Sat, 05 Aug 2017 11:35:09 GMT

Is it possible set up a monitoring of the data transfer rates between search head and indexer.
We are especially interested in the amount of data transferred for the scheduled searches that Enterprise Security runs every day. The transferred data per hour, ideally in form of a chart and a total value per day.

Thanks.

Re: Network Monitoring between Enterprise Security Search Head and Indexers

adonio — Sat, 05 Aug 2017 21:58:33 GMT

do you mean the amount of internal data that goes to _audit, _internal indexes?

Re: Network Monitoring between Enterprise Security Search Head and Indexers

shedalkar — Sun, 06 Aug 2017 10:00:16 GMT

yes. So is it possible to monitor this ? If yes, can you please let us know how ?

Re: Network Monitoring between Enterprise Security Search Head and Indexers

adonio — Sun, 06 Aug 2017 18:15:14 GMT

hello there,
you can use the eval len function on data from the particular search head you are after.
here is the code:

    index = _internal OR index = _audit host = <YourSearchHeadHere>
    | eval total_bytes = len(_raw)
    | eval bytes_kb = round(total_bytes/1024, 2)
    | eval bytes_mb = round(total_bytes/1024/1024, 2)
    | eval bytes_gb = round(total_bytes/1024/1024/1024, 2)
    | stats sum(bytes_*) as total_internal_audit_*  by host

here is a screenshot: