How do you check transfer speed from universal forwarder to indexer by event or file?

[human96]

how to check the transfer speed from UF to indexer ?

is it possible to check by events or source ?

[human96]

From my prospective , i believe  the indexing speed by source, sourcetype, host, or index can be calculated  using the below SPL or the search query.

index="_internal" source="*metrics.log" per_source_thruput series=ps | eval MB=kb/1024 | timechart span=5m sum(MB) by series

[gcusello]

Hi @human96,

probably your search is correct, even if i don't exactly understand what't your Use Case, what's series?

and generally, why invent hot water?

in the Monitorinbg Console you have all the searches to calculate all the needed metrics (indexing speed, license consuption, etc...).

I'd prefer a standard solution, but you could also use your search.

Tell me if I can help you more.

Ciao and happy splunking.

Giiuseppe

P.,S.: Karma Points are appreciated 😉

[gcusello]

Hi @human96,

using the Monitoring Console, you have all the information about data logs tranferred from each UF to Indexers.

[Settings -- Monitoring Console -- Forwarders]

If you don't have, you have to configure Monitoring Console to monitor UFs in [Settings -- Monitoring Console -- Settings -- Forwarders Monitoring Setup].

Ciao.

Giuseppe

[human96]

thanks for the quick response @gcusello , really appreciate this.
can we also check  by event or file (source)?

Will really appreciate if you could attach the splunk documentation.

[gcusello]

Hi @human96,

in the Monitoring Console, you have the traffic for each client sending logs.

If you want to knopw the weight of each file, you should count the chars of earch source.

You can find documentation about Monitoring Console at https://docs.splunk.com/Documentation/Splunk/8.2.4/DMC/DMCoverview

Ciao.

Giuseppe