Deployment Architecture

How can I calculate log transfer traffic from a particular host?

aparkale
New Member

How to check event log size in MB of particular host in index?
calculate log transfer traffic from particular host to Splunk cloud.

0 Karma

aparkale
New Member

I have changed the index= host= but still it doesn't provide any output.

0 Karma

alemarzu
Motivator

Try like this,

index=_internal host="*" source=*license_usage.log type="Usage" | stats sum(b) as b by h | eval mb=round(b/1024/1024, 3)
0 Karma

aparkale
New Member

still doesn't work for me...

0 Karma

alemarzu
Motivator

The above query will show you a table for all your hosts (UF's), bytes and MBs for each one of them. This is working for me, please check what @esix said.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Change the host="*" to the host="hostnameofinterest".. You need to make sure that the host is forwarding its logs to the indexer(s) and that your search head(s) are searching those indexers.

0 Karma

alemarzu
Motivator

Hi there @aparkale

Please try this search on your license master OR you can run it on your Search Head if you are forwarding internal logs to the Indexer.

index=_internal host=<HOSTNAME,IP> source=*license_usage.log type="Usage" | stats sum(b) as b by h | eval mb=round(b/1024/1024, 3)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!