Is there any data transfer rates between search head and indexers?

[sarwshai]

Just wanted to know is there any bandwidth rate for splunk search head to retrieve the logs from Indexers for search-ability?
If yes how one can find it?

[bmacias84]

I dont believe there is a good way. Also their are other transfers happening such as bundle replication. Though the search below may help.

`dmc_set_index_introspection` host=your search head sourcetype=splunk_resource_usage data.search_props.sid::* | stats max(data.written_mb) as mbWritten last(_time) as _time by data.search_props.sid | bucket _time span=1m | stats sum(mbWritten) as mbWrittenBySearch by _time

[bheemireddi]

sarwshai, Can you elaborate your question? are you experiencing any issues with search results or the rates at which you are expecting? is it slow?

[sarwshai]

No, there isn't any issue with search results, i want to specifically know the transfer rate of logs for the scheduled searches i have in my environment, i.e i want to calculate the data transfer(bps or eps) between my search head and indexer for the scheduled searches i have.