Splunk Search

Can I calculate the bandwidth used for site replication in an indexer clustering environment?

lycollicott
Motivator

If I use this search:

index=_internal source=*metrics.log* host="*indexer*" kbps=* | stats sum(kbps) by group,host

It tells me there are 4 groups with data:

per_host_thruput 
per_index_thruput
per_source_thruput
per_sourcetype_thruput 

None of those look like they will describe the replication traffic.
is there a way to determine how much bandwidth is being used by replication?

1 Solution

lycollicott
Motivator

This is what I figured out eventually.

index=_internal (host=*idnd01) (destIp="10.xx.xx.xx" OR destIp="10.yy.yy.yy") sourcetype=splunkd destPort=9887 
| timechart span=15m avg(tcp_KBps)

View solution in original post

lycollicott
Motivator

This is what I figured out eventually.

index=_internal (host=*idnd01) (destIp="10.xx.xx.xx" OR destIp="10.yy.yy.yy") sourcetype=splunkd destPort=9887 
| timechart span=15m avg(tcp_KBps)

slebbie_splunk
Splunk Employee
Splunk Employee

Hi Iycollicott, how does this search work for you?

0 Karma

lycollicott
Motivator

Very well. I use it in a dashboard panel everyday.

0 Karma

slebbie_splunk
Splunk Employee
Splunk Employee

Thanks, appreciated. "upvote" 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...