AutoLB Volume

[asabatini85]

Hi All,

I have 60 indexers and 40 forwarders, I want to set the AutoLB volume, do you know a metric search to calculate a correct value to balance the data load between the indexers?

[p_gurav · Accepted solution]

You can use autoLBVolume parameter in outputs.conf. Refer below document for more details:

https://docs.splunk.com/Documentation/Splunk/7.0.3/Admin/Outputsconf

[asabatini85]

Yes, I know the autoLBVolume parameter, I want to know if exist a metric search to calculate how much volume my architecture hold.

[p_gurav]

Try using below search:

index="_internal" source="*metrics.log" group="per_host_thruput" | chart sum(kb) by series | sort - sum(kb)

If you want license usage:

 index=_internal source="*license_usage.log" type=usage type=Usage idx=* pool="Your Pool Name" earliest=-30d@d latest=@d
 | eval GB = b
 | timechart limit=50 partial=false span=1d sum(eval(GB/1024/1024/1024)) by idx