Solved: Re: forwarder and indexing volume

templier · ‎07-03-2014

Hello friends!

Today there are very strange behavior on splunk server.

On the average Volume used today = 50-120MB
But today i has some crazy numbers = 2,936 MB, but number of events in the database about the same from day to day.

Prompt how can I trace with any of forwarders is so much traffic?

Thank you!

Ayn · ‎07-03-2014

You could check the metrics logs.

index=_internal source=*metrics.log group=per_host_thruput | eval MB=kb/1024 | stats sum(MB) by series

View solution in original post

Ayn · ‎07-03-2014

You could check the metrics logs.

index=_internal source=*metrics.log group=per_host_thruput | eval MB=kb/1024 | stats sum(MB) by series

forwarder and indexing volume

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Automating Threat Operations and Threat Hunting with Recorded Future

Keep the Learning Going with the New Best of .conf Hub

Splunk Community Badges!

Join the Conversation