You simply need to use the addtotals command: index=_internal source=*metrics.log splunk_server="*" | eval MB=kb/1024 | search group="per_host_thruput" | chart sum(MB) by series | addtotals ... View more

I recommend using the hosts metadata and searching for events received. Metadata contains when the last event was received from a specific host, source, or sourcetype. You can use a where statement that compares the last time an event was received to ensure that data is streaming. The reasons this is better than searching the splunkd log: You will know an event has actually come through The search itself is significantly faster The search I use is as follows: | metadata type=hosts | eval diff=now()-recentTime | where diff < 600 | convert ctime(*Time) This will tell you what hosts have sent data in the past 10 minutes. ... View more

If you turn on the debug flags for file monitoring, Splunk will tell you the status of that file. You can review how to set these flags here: http://www.splunk.com/wiki/Community:Troubleshooting_Monitor_Inputs Specifically, you should edit the $SPLUNK_HOME/etc/log.cfg file and set the following parameters: category.FileInputTracker=DEBUG category.selectProcessor=DEBUG category.TailingProcessor=DEBUG You will need to restart Splunk for the changes to take effect. Additionally, you should check for mod time and privileges of that file. Some files do not get released as Splunk would expect, and therefore we will not recognize changes to the file. This situation has been known to occur when monitoring Windows IIS logs. In these scenarios, using the "alwaysOpenFile" parameter becomes necessary. Using this parameter is not recommended. ... View more