Deployment Architecture

How can I calculate size of WAN traffic between hosts?

karlbosanquet
Path Finder

I have a multisite Indexer Cluster and Search Head Cluster and I want to identify what is the volume of data being replicated/sent over the WAN between each host, what would be the best way to do this?

0 Karma
1 Solution

lycollicott
Motivator

I use this to track indexer replication traffic between my two sites:

index=_internal (host=indexer*) (destIp="10.xx.xx.xx" OR destIp="10.yy.yy.yy") sourcetype=splunkd destPort=9887 
| timechart span=15m avg(tcp_KBps)

View solution in original post

0 Karma

lycollicott
Motivator

I use this to track indexer replication traffic between my two sites:

index=_internal (host=indexer*) (destIp="10.xx.xx.xx" OR destIp="10.yy.yy.yy") sourcetype=splunkd destPort=9887 
| timechart span=15m avg(tcp_KBps)
0 Karma

karlbosanquet
Path Finder

Is there a search that can be run to identify replicated data size and how often this happens? I need a volumetric profile of our WAN load.

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Bulk of the data replication will be between indexer's and that will depend on the RF and SF and indexing rate

0 Karma

karlbosanquet
Path Finder

both are 2.

Indexer 1 = Site 1
Indexer 2 = Site 2
Search Head 1 = Site 1
Search Head 2 = Site 1
Search Head 3 = Site 2

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...