Deployment Architecture

Bandwidth consumption - HF to IDX

Path Finder


My architecture is UF>HF>IDX. There is a VPN tunnel between HF and IDX. Is there a way I can have the VPN bandwidth utilization via splunk?

1) This VPN is dedicated for HF to IDX communication (and the only link between HF and IDX). There is no other traffic passing through it.
2) I don't have any other mechanism to check the VPN utilization.
3) Can we get the details from Splunk internal logs to see how much mbps/kbps data in total was sent over the tunnel during a given timeperiod?

A search would really be helpful


Tags (1)
0 Karma

Ultra Champion

Look at the _internal index for the metrics.log from your indexers, specifically for group=tcpin_connections. And then filter that for connections from your HFs.
Alternatively: do the same for the metrics.log from your HFs and look at the tcpout_connections metrics.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...