Splunk Search

Is there a metric search to define how many times load balanced forwarders switch indexers?

Path Finder

Hi Everyone,

Is there a metric Search to define how many times load balanced forwarders switch indexers?

Thank you.

0 Karma
1 Solution

Path Finder

I did this search by my self

index=internal source=*metrics.log "group=tcpinconnections" host=ip-10-0-163* | eval sourceHost=if(isnull(hostname), sourceHost,hostname)
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| eval version=if(isnull(version),"pre 4.2",version)
| rename version as Ver
| fields connectType sourceIp sourceHost destPort kb tcpeps tcpKprocessed tcpKBps splunkserver Ver
| eval Indexer= splunkserver
| eval Date=strftime(
time,"%d-%m-%Y %H:%M:%S")
| search connectType="heavy fwder"
| sort - time
| streamstats count, range(
time) as duration min(time) as mintime, max(time) as maxtime sum(tcpKprocessed) as kbprocessed, sum(tcpeps) as tcpeps by sourceIp destPort Indexer
| eval mbprocessed=kbprocessed/1024
| eventstats min(mbprocessed) as minmb avg(mbprocessed) as avgmb max(mbprocessed) as maxmb
| table count sourceIp, Indexer ,duration, tcpeps mbprocessed destPort minmb maxmb avg_mb

View solution in original post

Path Finder

I did this search by my self

index=internal source=*metrics.log "group=tcpinconnections" host=ip-10-0-163* | eval sourceHost=if(isnull(hostname), sourceHost,hostname)
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| eval version=if(isnull(version),"pre 4.2",version)
| rename version as Ver
| fields connectType sourceIp sourceHost destPort kb tcpeps tcpKprocessed tcpKBps splunkserver Ver
| eval Indexer= splunkserver
| eval Date=strftime(
time,"%d-%m-%Y %H:%M:%S")
| search connectType="heavy fwder"
| sort - time
| streamstats count, range(
time) as duration min(time) as mintime, max(time) as maxtime sum(tcpKprocessed) as kbprocessed, sum(tcpeps) as tcpeps by sourceIp destPort Indexer
| eval mbprocessed=kbprocessed/1024
| eventstats min(mbprocessed) as minmb avg(mbprocessed) as avgmb max(mbprocessed) as maxmb
| table count sourceIp, Indexer ,duration, tcpeps mbprocessed destPort minmb maxmb avg_mb

View solution in original post