- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to calculate splunk data size injected per day...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have multiple forwarders sending data into splunk index and I want to find size of each host sending data into splunk by forwarder.
Is there any way to calculate this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is unclear but maybe you can get what you need from the Data Summary:
http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary
Other than that you can run a search like this:
index=* OR index=_* | eval bytes=len(_raw) | stats sum(bytes) values(sourcetype) by host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is unclear but maybe you can get what you need from the Data Summary:
http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary
Other than that you can run a search like this:
index=* OR index=_* | eval bytes=len(_raw) | stats sum(bytes) values(sourcetype) by host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| stats sum(len) ? or sum(bytes)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Another typo. Fixed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What's the purpose of "index=* AND index=_*" ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My bad, it should be OR, not AND. I fixed it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock you query is what I was look for thanks for your help.
Get the T-shirt to Prove You Survived Splunk University Bootcamp
Introducing the Splunk Community Dashboard Challenge!
Wondering How to Build Resiliency in the Cloud?
