Splunk Search
Highlighted

query to find the forwarders sending too much data

Path Finder

Hi,

Below is the query i am using to find the forwarders sending more data than others for a specific sourcetype

index=index-name sourcetype=sourcetype-name | stats count by host | sort - count

is the above query correct ?

0 Karma
Highlighted

Re: query to find the forwarders sending too much data

SplunkTrust
SplunkTrust

Hi kteng,2024
| stats count will give you count of events but not how large the events are.
considering each forwarder is on a host and you would like to see which host sends the most data (in volume not count) you can look at the license master. here's a sample search to run manually as well:
earliest=-1d@d latest=@d index=internal source=*licenseusage.log* type=Usage
| stats sum(b) AS Bytes by h
| eval GB = Bytes/1024/1024/1024
| table h GB
| sort -GB
| addcoltotals

you can play with earliest and latest to pick your time or just puse time picker
you can also filter by other parameters then h
i = index
h = host
st = sourcetype

Cheers

0 Karma
Highlighted

Re: query to find the forwarders sending too much data

SplunkTrust
SplunkTrust

Firstly, I would use a tstats for this (using only metadata fields) type of queries.

| tstasts count WHERE index=index-name sourcetype=sourcetype-name by host | sort - count

Second, when you say more data, it could be more number of events or more amount of data being sent. You got the query for number of events. For amount of data, you would need to user license usage logs, something like this

index=_internal source=*license_usage.log type=Usage idx=index-name st=sourcetype-name | stats sum(b) as usage by h | sort -usage
0 Karma