I am trying to compile a report of the devices that send the most data to splunk minus our firewalls as they are obviously very chatty. I put together the following search
sourcetype!=cisco_firewall | top host showperc=false
That way it would exclude the firewalls from the results however even if I set this to the last 15 minutes it times out and does not complete. Am I doing something wrong?
Your search will display the number of event for each host, not really the volume.
this is one of the most costly search you can make...
You can use the metadata to have the same result faster :
| metadata type=hosts sourcetype!=cisco_firewall | table host totalCount | sort -totalCount
If you want to measure the volume of data send by host, you can search the _internal metrics. But you won't be able to filter per sourcetype.
index=_internal group="per_host_thruput" | eval mb=kb/1024| timechart span=1d sum(mb) by series | top 10 series
Oddly enough neither of those two searches work for me.
When I do a search for the first string my result is "no matching fields exist"
When I search on the second string I immediately get a return with 0 results.
You need to have permissions to search on the metadata and the _internal indexes. At least the Admin role can.
Your search will display the number of event for each host, not really the volume.
this is one of the most costly search you can make...
You can use the metadata to have the same result faster :
| metadata type=hosts sourcetype!=cisco_firewall | table host totalCount | sort -totalCount
If you want to measure the volume of data send by host, you can search the _internal metrics. But you won't be able to filter per sourcetype.
index=_internal group="per_host_thruput" | eval mb=kb/1024| timechart span=1d sum(mb) by series | top 10 series