Splunk Search

How to determine amount of data from a given host

mlevenson
Explorer

Been poking around and trying to figure out how to pull up how much data has been sent from a specific host.

For example host 123 is sending CPU data every 10sec, how much data is that over the course of time = "X"

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

This should do it - this shows how much data has been indexed from various hosts

index=_internal source=*metrics.log group="tcpin_connections" 
| eval sourceHost=if(isnull(hostname), sourceHost,hostname)
| stats sum(kb) as KB by sourceHost | eval KB = round(KB)

View solution in original post

lguinn2
Legend

This should do it - this shows how much data has been indexed from various hosts

index=_internal source=*metrics.log group="tcpin_connections" 
| eval sourceHost=if(isnull(hostname), sourceHost,hostname)
| stats sum(kb) as KB by sourceHost | eval KB = round(KB)

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!