How do I table the average KBps for all my indexers

[rholm01]

I am using the following command which gives me what I am looking for regarding a single indexer, but I would like a table listing all my indexers and heavy forwarders and the average tcp_KBps. I am trying to determine any network impact with and without compression.

index=_internal host=* source="*metrics.log*" destIp=REDACTED.* component=Metrics group=tcpout_connections | timechart avg(tcp_KBps) AS avg_KBps

HOST Average KBps

---

indexer-a 400.33333
indexer-b 8000.9999
syslog-a 500.33333
syslog-b 1000.55555
...

[richgalloway]

Try this. You may need to add a where clause to filter out non-indexer data.

index=_internal host=* source="*metrics.log*" destIp=* component=Metrics group=tcpout_connections 
| timechart avg(tcp_KBps) AS avg_KBps by destIp