https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64533#M180365 <P>how about this:</P> <PRE><CODE>index="_internal" source="*metrics.log*" per_host_thruput | timechart max(kbps) by series | addtotals </CODE></PRE> Wed, 06 Oct 2010 05:30:29 GMT Genti 2010-10-06T05:30:29Z https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64530#M180362 <P>Do you have any examples of searches capturing network thruput?</P> Wed, 06 Oct 2010 01:37:37 GMT https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64530#M180362 Kendrick33 2010-10-06T01:37:37Z https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64531#M180363 <P>Your question is not very clear without any information about the data source (input).</P> Wed, 06 Oct 2010 01:58:42 GMT https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64531#M180363 Simeon 2010-10-06T01:58:42Z https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64532#M180364 <P>I am monitoring a cluster of servers and am trying to capture the network thruput by host. I know splunk has a basic one out of the box. <CODE>Thrput_by_host(*)</CODE>. However, I would like to be able to pinpoint the thruput of each server. When I attempted to hone the search, I couldn't get any data back. For example</P> <P>Thruput_by_host(*) | timechart span=24h avg(Thruput_by_host()) as AvgHostThruput, AvgHostThruput renders nothing.</P> Mon, 28 Sep 2020 09:18:40 GMT https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64532#M180364 Kendrick33 2020-09-28T09:18:40Z https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64533#M180365 <P>how about this:</P> <PRE><CODE>index="_internal" source="*metrics.log*" per_host_thruput | timechart max(kbps) by series | addtotals </CODE></PRE> Wed, 06 Oct 2010 05:30:29 GMT https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64533#M180365 Genti 2010-10-06T05:30:29Z https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64534#M180366 <P>Splunk will track the top 10 inputs based on source and host. To retrieve that information, you could run the following search:</P> <PRE><CODE>index=_internal source=*metrics.log* per_host_thruput | timechart sum(kb) by series </CODE></PRE> <P>To increase the number of tracked inputs, you can set that in your limits.conf file for metrics tracking.</P> Wed, 06 Oct 2010 05:40:39 GMT https://community.splunk.com/t5/Splunk-Search/examples-of-searches-to-capture-network-thruput/m-p/64534#M180366 Simeon 2010-10-06T05:40:39Z