Splunk Search

How to find how much data is flowing through a particular HEC token in Splunk?

Hemnaath
Motivator

Hi All,   Can any one guide me how to find, how much data is getting ingested into Splunk from a particular HEC token and how much volume of data a single HEC token handle? 

Reason: Currently we are using single token to ingest multiple API data in to splunk and recently our clients wanted to ingest another API data into Splunk,  instead of creating a new token we are planning to use the same token for API data ingestion but before using the same token, we wanted to assess the current data  ingestion by the HEC, to avoid data loss. 

Need a query to fetch the avg data volume consumed by the HEC token per day.

 

Labels (1)
Tags (1)
0 Karma

Hemnaath
Motivator

thanks maciep,  for your effort on this, using the below query I was able to achieve the size of data.

in our case particular token was sending data to a particular index/sourcetype, so I used below query to calculate  the size 

index= "index name" | eval size=len(_raw) | eval gbsize=(size/1024/1024/1024) | timcechart span=1d sum(gbsize) 

OR 

index=_internal idx= "index name"  | timechart span=1d eval(sum(b)/(1024*1024*1024)) as GB by idx 

To get the size of the data ingested through particular HEC token.

index="_introspection" source="hhtp_event_collector_metrics" "data.token_name"="token name" | rename "data.total_bytes_indexed as b | timechart span=1d eval (sum(b)/(1024*1024*1024)) as GB by  "data.token_name"

maciep
Champion

it's been a while since I had access to this data (so I can't put a search together for you), but I believe the _introspection index is where you may want to start.  Maybe this other post will be helpful:  What is included in HEC introspection data? 

0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...