Splunk Search

Show top sources for splunk failing

charlestips
Explorer

I am trying to compile a report of the devices that send the most data to splunk minus our firewalls as they are obviously very chatty. I put together the following search

sourcetype!=cisco_firewall | top host showperc=false

That way it would exclude the firewalls from the results however even if I set this to the last 15 minutes it times out and does not complete. Am I doing something wrong?

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Your search will display the number of event for each host, not really the volume.
this is one of the most costly search you can make...

You can use the metadata to have the same result faster :


| metadata type=hosts sourcetype!=cisco_firewall | table host totalCount | sort -totalCount

If you want to measure the volume of data send by host, you can search the _internal metrics. But you won't be able to filter per sourcetype.


index=_internal group="per_host_thruput" | eval mb=kb/1024| timechart span=1d sum(mb) by series | top 10 series

look at this page to find other cool searches :
http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

View solution in original post

charlestips
Explorer

Oddly enough neither of those two searches work for me.

When I do a search for the first string my result is "no matching fields exist"

When I search on the second string I immediately get a return with 0 results.

0 Karma

yannK
Splunk Employee
Splunk Employee

You need to have permissions to search on the metadata and the _internal indexes. At least the Admin role can.

0 Karma

yannK
Splunk Employee
Splunk Employee

Your search will display the number of event for each host, not really the volume.
this is one of the most costly search you can make...

You can use the metadata to have the same result faster :


| metadata type=hosts sourcetype!=cisco_firewall | table host totalCount | sort -totalCount

If you want to measure the volume of data send by host, you can search the _internal metrics. But you won't be able to filter per sourcetype.


index=_internal group="per_host_thruput" | eval mb=kb/1024| timechart span=1d sum(mb) by series | top 10 series

look at this page to find other cool searches :
http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...