Bandwith between SearchHeads and ClusterPeers

[salem34]

Hi Folks

Is there a way to analyze the bandwith used between the SearchHeads and the indexer cluster peers?

I know this has many dependencies on the search and its artifacts but we do need to have a rough calculation to size the environment.

Any help is appreciated.

Cheers, Claudio

[richgalloway]

Splunk recommends a 1GB ethernet interface.  Any estimate beyond would be wild speculation given what we know about your environment.

[salem34]

The question is whether there is a way to report on the used bandwith using splunk logs- 

[richgalloway]

I misunderstood the question and thought you wanted to estimate the network usage prior to installing Splunk.

For an existing environment, the best answer probably will come from your Network team.  They should have the tools to fairly accurately measure the data flow between Splunk instances.

Other than that, I think you'll be stuck trying to find the information from Splunk.  There are metrics on the amount of data ingested, but little on the amount of data sent between instances.