Network Monitoring between Enterprise Security Search Head and Indexers

[shedalkar]

Is it possible set up a monitoring of the data transfer rates between search head and indexer.
We are especially interested in the amount of data transferred for the scheduled searches that Enterprise Security runs every day. The transferred data per hour, ideally in form of a chart and a total value per day.

Thanks.

[adonio]

hello there,
you can use the eval len function on data from the particular search head you are after.
here is the code:

    index = _internal OR index = _audit host = <YourSearchHeadHere>
    | eval total_bytes = len(_raw)
    | eval bytes_kb = round(total_bytes/1024, 2)
    | eval bytes_mb = round(total_bytes/1024/1024, 2)
    | eval bytes_gb = round(total_bytes/1024/1024/1024, 2)
    | stats sum(bytes_*) as total_internal_audit_*  by host

here is a screenshot:

[adonio]

do you mean the amount of internal data that goes to _audit, _internal indexes?

[shedalkar]

yes. So is it possible to monitor this ? If yes, can you please let us know how ?