Splunk Search

Can I calculate the bandwidth used for site replication in an indexer clustering environment?

lycollicott
Motivator

If I use this search:

index=_internal source=*metrics.log* host="*indexer*" kbps=* | stats sum(kbps) by group,host

It tells me there are 4 groups with data:

per_host_thruput 
per_index_thruput
per_source_thruput
per_sourcetype_thruput 

None of those look like they will describe the replication traffic.
is there a way to determine how much bandwidth is being used by replication?

1 Solution

lycollicott
Motivator

This is what I figured out eventually.

index=_internal (host=*idnd01) (destIp="10.xx.xx.xx" OR destIp="10.yy.yy.yy") sourcetype=splunkd destPort=9887 
| timechart span=15m avg(tcp_KBps)

View solution in original post

lycollicott
Motivator

This is what I figured out eventually.

index=_internal (host=*idnd01) (destIp="10.xx.xx.xx" OR destIp="10.yy.yy.yy") sourcetype=splunkd destPort=9887 
| timechart span=15m avg(tcp_KBps)

slebbie_splunk
Splunk Employee
Splunk Employee

Hi Iycollicott, how does this search work for you?

0 Karma

lycollicott
Motivator

Very well. I use it in a dashboard panel everyday.

0 Karma

slebbie_splunk
Splunk Employee
Splunk Employee

Thanks, appreciated. "upvote" 🙂

0 Karma
Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...