Solved: forwarder and indexing volume

templier · ‎07-03-2014

Hello friends!

Today there are very strange behavior on splunk server.

On the average Volume used today = 50-120MB
But today i has some crazy numbers = 2,936 MB, but number of events in the database about the same from day to day.

Prompt how can I trace with any of forwarders is so much traffic?

Thank you!

Ayn · ‎07-03-2014

You could check the metrics logs.

index=_internal source=*metrics.log group=per_host_thruput | eval MB=kb/1024 | stats sum(MB) by series

View solution in original post

Ayn · ‎07-03-2014

You could check the metrics logs.

index=_internal source=*metrics.log group=per_host_thruput | eval MB=kb/1024 | stats sum(MB) by series

forwarder and indexing volume

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation