Show top sources for splunk failing

[charlestips]

I am trying to compile a report of the devices that send the most data to splunk minus our firewalls as they are obviously very chatty. I put together the following search

sourcetype!=cisco_firewall | top host showperc=false

That way it would exclude the firewalls from the results however even if I set this to the last 15 minutes it times out and does not complete. Am I doing something wrong?

[charlestips]

Oddly enough neither of those two searches work for me.

When I do a search for the first string my result is "no matching fields exist"

When I search on the second string I immediately get a return with 0 results.

[yannK]

You need to have permissions to search on the metadata and the _internal indexes. At least the Admin role can.

[yannK · Accepted solution]

Your search will display the number of event for each host, not really the volume.
this is one of the most costly search you can make...

You can use the metadata to have the same result faster :

| metadata type=hosts  sourcetype!=cisco_firewall | table host totalCount | sort -totalCount

If you want to measure the volume of data send by host, you can search the _internal metrics. But you won't be able to filter per sourcetype.

index=_internal group="per_host_thruput" | eval mb=kb/1024| timechart span=1d sum(mb) by series | top 10 series

look at this page to find other cool searches :
http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume