Measure incoming network traffic on heavy forwarders

[splunkreal]

Hello, is this query valid to check incoming network traffic to heavyforwarders?

index=_internal source=*metrics.log* group=tcpin_connections (host=s*HF*) | eval mb=floor(kb/1024) | timechart sum(mb) as mb span=5min useother=f usenull=f by host

Thanks.

[livehybrid]

Hi @splunkreal 

You want to use 'hostname' not host in that search:

index=_internal source=*metrics.log* group=tcpin_connections (hostname=s*HF*) 
| eval mb=(kb/1024) 
| timechart sum(mb) as mb span=5min useother=f usenull=f by hostname

Using wildcards within a value isnt recommended but wont stop your search running.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[splunkreal]

Hi @livehybrid @PickleRick  doesn't seem to work with HEC port (8088)

[PickleRick]

Yes. HEC data should be IIRC listed in another group (http_connections?)

[PickleRick]

Actually, a wildcard within a searched term can lead to wrong results. Depends whether the term contains breakers.