query to find the forwarders sending too much data

[kteng2024]

Hi,

Below is the query i am using to find the forwarders sending more data than others for a specific sourcetype

index=index-name sourcetype=sourcetype-name | stats count by host | sort - count

is the above query correct ?

[somesoni2]

Firstly, I would use a tstats for this (using only metadata fields) type of queries.

| tstasts count WHERE index=index-name sourcetype=sourcetype-name by host | sort - count

Second, when you say more data, it could be more number of events or more amount of data being sent. You got the query for number of events. For amount of data, you would need to user license usage logs, something like this

index=_internal source=*license_usage.log type=Usage idx=index-name st=sourcetype-name | stats sum(b) as usage by h | sort -usage

[adonio]

Hi kteng,2024
| stats count will give you count of events but not how large the events are.
considering each forwarder is on a host and you would like to see which host sends the most data (in volume not count) you can look at the license master. here's a sample search to run manually as well:
earliest=-1d@d latest=@d index=_internal source=license_usage.log type=Usage
| stats sum(b) AS Bytes by h
| eval GB = Bytes/1024/1024/1024
| table h GB
| sort -GB
| addcoltotals

you can play with earliest and latest to pick your time or just puse time picker
you can also filter by other parameters then h
i = index
h = host
st = sourcetype

Cheers