Traffic ingest monitoring

[Babi2002]

Hi to all,

I'm a newbee in Splunk and I need to check If the Splunk Cloud is receiving traffic form our network infrastructure. I have thought to do via API request but I don't find the url where to do the request.

Could anybody to send me where I can find documentation to do this??? Or how can I do this??

Thanks in advance!!

David.

[tscroggins]

Hi,

Connection metrics are logged by splunkd to metrics.log. To search metrics.log directly replace ... in the following search with a space-delimited list of your expected egress addresses:

index=_internal source=*metrics.log* host=idx-i-* group=tcpin_connections sourceIp IN (...)

The same data is also logged to the _metrics metrics index:

| mstats avg(spl.mlog.tcpin_connections._tcp_KBps) as KBps where index=_metrics group=tcpin_connections sourceIp IN (...) by sourceIp

You can use the search/jobs endpoint to run an asynchronous or blocking request to execute one of the search above. See https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/RESTREF/RESTsearch#search.2Fjobs for more information.