Splunk Search

Can I calculate the bandwidth used for site replication in an indexer clustering environment?

lycollicott
Motivator

If I use this search:

index=_internal source=*metrics.log* host="*indexer*" kbps=* | stats sum(kbps) by group,host

It tells me there are 4 groups with data:

per_host_thruput 
per_index_thruput
per_source_thruput
per_sourcetype_thruput 

None of those look like they will describe the replication traffic.
is there a way to determine how much bandwidth is being used by replication?

1 Solution

lycollicott
Motivator

This is what I figured out eventually.

index=_internal (host=*idnd01) (destIp="10.xx.xx.xx" OR destIp="10.yy.yy.yy") sourcetype=splunkd destPort=9887 
| timechart span=15m avg(tcp_KBps)

View solution in original post

lycollicott
Motivator

This is what I figured out eventually.

index=_internal (host=*idnd01) (destIp="10.xx.xx.xx" OR destIp="10.yy.yy.yy") sourcetype=splunkd destPort=9887 
| timechart span=15m avg(tcp_KBps)

slebbie_splunk
Splunk Employee
Splunk Employee

Hi Iycollicott, how does this search work for you?

0 Karma

lycollicott
Motivator

Very well. I use it in a dashboard panel everyday.

0 Karma

slebbie_splunk
Splunk Employee
Splunk Employee

Thanks, appreciated. "upvote" 🙂

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...