I have an account that I am headed to 11/09/2011 that the Internet is slowing down at different times of the day. I'd like to monitor the traffic of the site and see what could be the issue. There is no server installed, just about 10 users doing data entry and accessing the Internet.
How can I setup Splunk to monitor and see what's causing the slow down?
Obviously, you would need some kind of data source that describes the flow of traffic through the Internet connection. For most folks, this would mean getting data out of the edge router.
One data source is SNMP counters. You can script up snmpget to log data about ifInOctets and ifOutOctets on the router, and then Splunk that. This will tell you if there is a bandwidth issue, but not necessarily what is causing it.
Another data source is Netflow. There is an app for that which enables Splunk to load/process Netflow data. However, not all routers have the ability to export Netflow data.
Your mileage may vary in using either of these to resolve your client's issue. This isn't an incredibly straightforward problem to resolve either with Splunk or without.