Getting Data In

how to check traffic volume per heavy forawrder

New Member

I plan to calculate the traffic volume in GB across all our HFs. Need this to ensure check which HF is getting max traffic as this is affecting. I was able to get memory, cpu and bandwidth utilization from index= _interospection and index=_internal

0 Karma

SplunkTrust
SplunkTrust

If you are looking for total volume sent (including _internal) and not just license usage here is a good search:

index=_internal sourcetype=splunkd group=tcpin_connections (connectionType=cooked OR connectionType=cookedSSL) fwdType=* guid=* 
| eval dest_uri = host.":".destPort 
| stats values(fwdType) as forwarder_type, latest(version) as version, values(arch) as arch, dc(dest_uri) as dest_count, values(os) as os, max(_time) as last_connected, sum(kb) as new_sum_kb, sparkline(avg(tcp_KBps), 1m) as avg_tcp_kbps_sparkline, avg(tcp_KBps) as avg_tcp_kbps, avg(tcp_eps) as avg_tcp_eps by guid, hostname 
| eval hostname = upper(hostname)

This provides quite a bit of extra info. You can convert kb to GB as needed.

0 Karma

SplunkTrust
SplunkTrust

Hi hkumar26,
see Splunk Distributed Monitoring Console App and you can find your searches.
Bye.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

do you mean license usage? e.g. raw data received by indexers through Heavy Forwarders?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!