Splunk Search

find host reporting to various indexers.

sanju005ind
Communicator

I have hosts/forwarders reporting to multiple indexers using load balancing.I have 3 in Americas,2 in Aspac.

I am able to get the output using the query index="_internal" source="*metrics.log" per_host_thruput | chart sum(kb) by series, splunk_server.

I want to get the output with the following columns host,TotalVolume,Indexer/s

Could you please help.

Tags (1)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You should be able to search:

index=_internal source=*.metrics.log group=per_host_thruput | stats sum(kb) as TotalVolume values(splunk_server) as "Indexer/s" by series | rename series as host

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

You should be able to search:

index=_internal source=*.metrics.log group=per_host_thruput | stats sum(kb) as TotalVolume values(splunk_server) as "Indexer/s" by series | rename series as host

sanju005ind
Communicator

Thanks a lot Stephen.

0 Karma

Simeon
Splunk Employee
Splunk Employee

What do you mean by host? Do you mean forwarder?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...