Getting Data In

Hosts with the largest events in size?

kwaingrow
Path Finder

In an effort to police my license usage, I'm currently using the following to find the hosts with the largest number of events sending to Splunk in the last 5 minutes:

index=* earliest=-5m | stats count by host,splunk_server | sort -count

While a host may be spamming Splunk with events, they may not be that large and affect my license usage that much. What can I use to find the hosts that are sending the actual largest (in size) events by host,splunk_server taking up the most space in the last 5 minutes?

Tags (3)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

You would want to do something like below (value in bytes).

index=* earliest=-5m | eval esize=len(_raw) | stats count max(esize) by host, source

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You can also just check the license_usage.log, which breaks down the number of indexed bytes by host, source, and sourcetype, and indexer:

index=_internal source=*license_usage.log | stats sum(b) by s,st,h,i

though the indexer is represented by GUID rather than name in this case. You can of course roll up:

index=_internal source=*license_usage.log | stats sum(b) by s,h

as usual.

sdaniels
Splunk Employee
Splunk Employee

You would want to do something like below (value in bytes).

index=* earliest=-5m | eval esize=len(_raw) | stats count max(esize) by host, source

kwaingrow
Path Finder

I like it. I can pin it to a specific source. Thanks.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>