Getting Data In

How do I find out which hosts are pushing the most data to our Splunk Cloud account? Volume usage showing a spike.

clearslide_cwon
New Member

Not sure how I can find out which host(s) that are pushing the most data/logs to our Splunk Cloud account. It's reaching our limit.
Unfortunately, the Volume Usage tab isn't very detailed.

Tags (3)
0 Karma

sundareshr
Legend

Try this

index=_internal source=*license_usage.log* type=Usage | timechart span=1h sum(b) AS vol by h
0 Karma

rsolutions
Path Finder

You could always just search the raw logs (may take a while if you have a lot of data)... index=* earliest=-7d@d latest=@d | eval size=len(_raw)/1024/1024 | timechart sum(size) by host

0 Karma

rsolutions
Path Finder

This looks good as a line or area chart... you can easily see what host has has a significant increase. If you find the host... add it to the base search and the edit the timechart to be by sourcetype. This should help you zero in on what has caused the recent increase in logging.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...