Deployment Architecture

How can I calculate log transfer traffic from a particular host?

aparkale
New Member

How to check event log size in MB of particular host in index?
calculate log transfer traffic from particular host to Splunk cloud.

0 Karma

aparkale
New Member

I have changed the index= host= but still it doesn't provide any output.

0 Karma

alemarzu
Motivator

Try like this,

index=_internal host="*" source=*license_usage.log type="Usage" | stats sum(b) as b by h | eval mb=round(b/1024/1024, 3)
0 Karma

aparkale
New Member

still doesn't work for me...

0 Karma

alemarzu
Motivator

The above query will show you a table for all your hosts (UF's), bytes and MBs for each one of them. This is working for me, please check what @esix said.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Change the host="*" to the host="hostnameofinterest".. You need to make sure that the host is forwarding its logs to the indexer(s) and that your search head(s) are searching those indexers.

0 Karma

alemarzu
Motivator

Hi there @aparkale

Please try this search on your license master OR you can run it on your Search Head if you are forwarding internal logs to the Indexer.

index=_internal host=<HOSTNAME,IP> source=*license_usage.log type="Usage" | stats sum(b) as b by h | eval mb=round(b/1024/1024, 3)
0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...