If I use this search:
index=_internal source=*metrics.log* host="*indexer*" kbps=* | stats sum(kbps) by group,host
It tells me there are 4 groups with data:
per_host_thruput per_index_thruput per_source_thruput per_sourcetype_thruput
None of those look like they will describe the replication traffic.
is there a way to determine how much bandwidth is being used by replication?
This is what I figured out eventually.
index=_internal (host=*idnd01) (destIp="10.xx.xx.xx" OR destIp="10.yy.yy.yy") sourcetype=splunkd destPort=9887 | timechart span=15m avg(tcp_KBps)