Data calculate from heavy forwarders and intermediate forwarders to indexer cluster

[Mani2]

Hi,

I wanted to check that how can I get total data transfer from on-prem heavy forwarders and intermediate forwarders to cloud indexer cluster? is there a search which can look into splunkd.log or metrics.log from heavy forwarder for data transferred for 24 hours...

[richgalloway]

Perhaps this will help

index=_internal host=<<forwarder name>> component=Metrics name=thruput earliest=-24h
| stats sum(total_k_processed) as "total data transfer"

[Mani2]

Thanks Rich, that helps.
How can I get it in MB or GB as it is tough to read "91345084304594.000"

[Mani2]

Sorry missed to ask,

And how can I see same in this search result for multiple hosts ?

[richgalloway]

Easy-peasy

index=_internal host=* component=Metrics name=thruput earliest=-24h
| stats sum(total_k_processed) as "total data transfer" by host
```Convert KB to GB```
| eval "total data transfer" = 'total data transfer'/1024/1024