Getting Data In

Network Monitoring between Enterprise Security Search Head and Indexers

Engager

Is it possible set up a monitoring of the data transfer rates between search head and indexer.
We are especially interested in the amount of data transferred for the scheduled searches that Enterprise Security runs every day. The transferred data per hour, ideally in form of a chart and a total value per day.

Thanks.

0 Karma

SplunkTrust
SplunkTrust

hello there,
you can use the eval len function on data from the particular search head you are after.
here is the code:

    index = _internal OR index = _audit host = <YourSearchHeadHere>
    | eval total_bytes = len(_raw)
    | eval bytes_kb = round(total_bytes/1024, 2)
    | eval bytes_mb = round(total_bytes/1024/1024, 2)
    | eval bytes_gb = round(total_bytes/1024/1024/1024, 2)
    | stats sum(bytes_*) as total_internal_audit_*  by host

here is a screenshot:
alt text

0 Karma

SplunkTrust
SplunkTrust

do you mean the amount of internal data that goes to _audit, _internal indexes?

0 Karma

Engager

yes. So is it possible to monitor this ? If yes, can you please let us know how ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!