Splunk Search

examples of searches to capture network thruput

Kendrick33
Explorer

Do you have any examples of searches capturing network thruput?

Tags (1)
0 Karma

Simeon
Splunk Employee
Splunk Employee

Splunk will track the top 10 inputs based on source and host. To retrieve that information, you could run the following search:

index=_internal source=*metrics.log* per_host_thruput | timechart sum(kb) by series

To increase the number of tracked inputs, you can set that in your limits.conf file for metrics tracking.

Genti
Splunk Employee
Splunk Employee

how about this:

index="_internal" source="*metrics.log*" per_host_thruput | timechart max(kbps) by series | addtotals
0 Karma

Kendrick33
Explorer

I am monitoring a cluster of servers and am trying to capture the network thruput by host. I know splunk has a basic one out of the box. Thrput_by_host(*). However, I would like to be able to pinpoint the thruput of each server. When I attempted to hone the search, I couldn't get any data back. For example

Thruput_by_host(*) | timechart span=24h avg(Thruput_by_host()) as AvgHostThruput, AvgHostThruput renders nothing.

0 Karma

Simeon
Splunk Employee
Splunk Employee

Your question is not very clear without any information about the data source (input).

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...