Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Is there a query for the indexers to find the nosiest forwarders in the last 24 hours?

mattholt
New Member
‎02-09-2016 09:21 AM

We need to find the most talkative indexers within Splunk for the last 24 hour period.

Tags (1)
0 Karma
Reply

renjith_nair
Legend
‎02-09-2016 10:00 AM

This might help you to find the amount of data sent by forwarders 

index=_internal sourcetype=splunkd group=per_host_thruput earliest=-24h| stats sum(kb) as total by series|rename seties as Host|sort - total
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Reply
Get Updates on the Splunk Community!

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...