topic find host reporting to various indexers. in Splunk Search

find host reporting to various indexers.

sanju005ind — Fri, 12 Nov 2010 23:09:45 GMT

I have hosts/forwarders reporting to multiple indexers using load balancing.I have 3 in Americas,2 in Aspac.

I am able to get the output using the query index="_internal" source="*metrics.log" per_host_thruput | chart sum(kb) by series, splunk_server.

I want to get the output with the following columns host,TotalVolume,Indexer/s

Could you please help.

Re: find host reporting to various indexers.

Simeon — Sat, 13 Nov 2010 00:44:34 GMT

What do you mean by host? Do you mean forwarder?

Re: find host reporting to various indexers.

Stephen_Sorkin — Sat, 13 Nov 2010 07:48:40 GMT

You should be able to search:

index=_internal source=*.metrics.log group=per_host_thruput | stats sum(kb) as TotalVolume values(splunk_server) as "Indexer/s" by series | rename series as host

Re: find host reporting to various indexers.

sanju005ind — Mon, 15 Nov 2010 20:29:12 GMT

Thanks a lot Stephen.