Deployment Architecture

How can I calculate log transfer traffic from a particular host?

aparkale
New Member

How to check event log size in MB of particular host in index?
calculate log transfer traffic from particular host to Splunk cloud.

0 Karma

aparkale
New Member

I have changed the index= host= but still it doesn't provide any output.

0 Karma

alemarzu
Motivator

Try like this,

index=_internal host="*" source=*license_usage.log type="Usage" | stats sum(b) as b by h | eval mb=round(b/1024/1024, 3)
0 Karma

aparkale
New Member

still doesn't work for me...

0 Karma

alemarzu
Motivator

The above query will show you a table for all your hosts (UF's), bytes and MBs for each one of them. This is working for me, please check what @esix said.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Change the host="*" to the host="hostnameofinterest".. You need to make sure that the host is forwarding its logs to the indexer(s) and that your search head(s) are searching those indexers.

0 Karma

alemarzu
Motivator

Hi there @aparkale

Please try this search on your license master OR you can run it on your Search Head if you are forwarding internal logs to the Indexer.

index=_internal host=<HOSTNAME,IP> source=*license_usage.log type="Usage" | stats sum(b) as b by h | eval mb=round(b/1024/1024, 3)
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...