Solved: forwarder and indexing volume

templier · ‎07-03-2014

Hello friends!

Today there are very strange behavior on splunk server.

On the average Volume used today = 50-120MB
But today i has some crazy numbers = 2,936 MB, but number of events in the database about the same from day to day.

Prompt how can I trace with any of forwarders is so much traffic?

Thank you!

Ayn · ‎07-03-2014

You could check the metrics logs.

index=_internal source=*metrics.log group=per_host_thruput | eval MB=kb/1024 | stats sum(MB) by series

View solution in original post

Ayn · ‎07-03-2014

You could check the metrics logs.

index=_internal source=*metrics.log group=per_host_thruput | eval MB=kb/1024 | stats sum(MB) by series

forwarder and indexing volume

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation