- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to create an alert for any forwarders that are reaching max thruput consistently?
index=_internal source="*splunkd.log" | eval KBps=tcp_Bps/1024 | stats sum(KBps) as throughput by host | where throughput > 5000 This gives the sum of the thruput for an entire day but I need to know exactly which forwarders are throttling.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi. Can you look at this answer? https://answers.splunk.com/answers/584191/need-a-search-alert-query-when-the-forwarder-reach.html#an...
It's the alert I use to show me the hosts that are being throttled.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi. Can you look at this answer? https://answers.splunk.com/answers/584191/need-a-search-alert-query-when-the-forwarder-reach.html#an...
It's the alert I use to show me the hosts that are being throttled.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
number of times the hosts are throttling frequently
