Is it possible set up a monitoring of the data transfer rates between search head and indexer.
We are especially interested in the amount of data transferred for the scheduled searches that Enterprise Security runs every day. The transferred data per hour, ideally in form of a chart and a total value per day.
you can use the eval len function on data from the particular search head you are after.
here is the code:
index = _internal OR index = _audit host = <YourSearchHeadHere> | eval total_bytes = len(_raw) | eval bytes_kb = round(total_bytes/1024, 2) | eval bytes_mb = round(total_bytes/1024/1024, 2) | eval bytes_gb = round(total_bytes/1024/1024/1024, 2) | stats sum(bytes_*) as total_internal_audit_* by host
here is a screenshot: