Determine The Amount Of Data Forwarded By Splunk Forwarder Over Time X

[tehmasp]

Want to know if there is an easy way to check the amount of data a Splunk Forwarder on a box has forwarded to an Indexer over some period of time? Is this data logged somewhere? Is there a Splunk search I can do w/ a 'host' attribute and determine the amount of raw data collected over the search period? Thanks!

[tehmasp]

Ah, right. I have this installed but don't use it nearly often. Thanks!

My reason for asking was to get a better idea of the amount of data forwarded by certain classes of forwarders in our environment as to better set the MaxQueueSize in outputs.conf in the event of Indexer failure.

[_d_]

No problems. Please consider upvoting and accepting the answer so that other members can benefit from it. Thanks.

[_d_ · Accepted solution]

Yes, install Deployment Monitor app on Splunk Indexer and you will have access to really useful information/charts/dashboards about all your splunk instances including what you're looking for and more. If you are on Splunk 4.2.3 or later you just have to enable it (as it comes with it).
Otherwise use this link to get it: http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Hope this helps

> please upvote and accept answer if you find it useful - thanks!