Splunk Search

How to determine if forwarder weight distribution is good from search?

mhouse
New Member

I need help figuring something out.

Got this search during .conf19 to be used to do a Forwarder weight distribution search:

index=_internal Metrics sourcetype=splunkd TERM(group=tcpin_connections) earliest=-4hr latest=now [|dbinspect index=_* 
|stats values(splunk_server) as indexer 
|eval search="host IN (".mvjoin(mvfilter(indexer!=""),",").")"] 
|stats sum(kb) as throughput by hostname 
|sort - throughput 
|eventstats sum(throughput) as total_throughput dc(hostname) as all_forwarders 
|streamstats sum(throughput) as accumlated_throughput count by all_forwarders 
|eval coverage=accumlated_throughput/total_throughput, progress_through_forwarders=count/all_forwarders 
|bin progress_through_forwarders bins=100 
|stats max(coverage) as coverage by progress_through_forwarders all_forwarders 
|fields progress_through_forwarders coverage

How do I interpret the results from this search? If the numerical representation of coverage is within 0.1 across all results is that success? Across 100 results, the coverage values range from 0.82594059014 to 1.0000000.

0 Karma

codebuilder
Influencer

If you are using indexer discovery, then the monitoring console on the master will provide a tremendous amount of information regarding your forwarders. Including status, thruput, distribution, and much more.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mhouse,
did you already explored the Management Console?
probably there's that you're searching: I used it for a customer some months ago.

Ciao.
Giuseppe

0 Karma

mhouse
New Member

I don't understand your question. I ran my query on the SH and I am seeking help in understanding the results.

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...