How to check traffic volume per heavy forwarder?

[hkumar26]

I plan to calculate the traffic volume in GB across all our HFs. Need this to ensure check which HF is getting max traffic as this is affecting. I was able to get memory, cpu and bandwidth utilization from index= _interospection and index=_internal

[thambisetty]

index=_internal host IN ("yourheavyforwarders") group=per_index_thruput | stats sum(kb) as kb by host
| eval GB=round(kb/1024/1024,2) | fields - kb

Note: if you want to exclude internal indexes which are starting with _(underscore), you can use below search

index=_internal host IN ("yourheavyforwarders") group=per_index_thruput series!=_* | stats sum(kb) as kb by host
| eval GB=round(kb/1024/1024,2) | fields - kb

[mdsnmss]

If you are looking for total volume sent (including _internal) and not just license usage here is a good search:

index=_internal sourcetype=splunkd group=tcpin_connections (connectionType=cooked OR connectionType=cookedSSL) fwdType=* guid=* 
| eval dest_uri = host.":".destPort 
| stats values(fwdType) as forwarder_type, latest(version) as version, values(arch) as arch, dc(dest_uri) as dest_count, values(os) as os, max(_time) as last_connected, sum(kb) as new_sum_kb, sparkline(avg(tcp_KBps), 1m) as avg_tcp_kbps_sparkline, avg(tcp_KBps) as avg_tcp_kbps, avg(tcp_eps) as avg_tcp_eps by guid, hostname 
| eval hostname = upper(hostname)

This provides quite a bit of extra info. You can convert kb to GB as needed.

[gcusello]

Hi hkumar26,
see Splunk Distributed Monitoring Console App and you can find your searches.
Bye.
Giuseppe

[adonio]

do you mean license usage? e.g. raw data received by indexers through Heavy Forwarders?