How to alert which forwarders are throttling?

[mamari32825]

How to create an alert for any forwarders that are reaching max thruput consistently?

index=_internal source="*splunkd.log" | eval KBps=tcp_Bps/1024 | stats sum(KBps) as throughput by host | where throughput > 5000 This gives the sum of the thruput for an entire day but I need to know exactly which forwarders are throttling.

[burwell · Accepted solution]

Hi. Can you look at this answer? https://answers.splunk.com/answers/584191/need-a-search-alert-query-when-the-forwarder-reach.html#an...

It's the alert I use to show me the hosts that are being throttled.

[mamari32825]

number of times the hosts are throttling frequently