Getting Data In

How to calculate splunk data size injected per day or time based on forwarders

vradhakrishnan
Engager

I have multiple forwarders sending data into splunk index and I want to find size of each host sending data into splunk by forwarder.
Is there any way to calculate this.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

It is unclear but maybe you can get what you need from the Data Summary:

http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary

Other than that you can run a search like this:

index=* OR index=_* | eval bytes=len(_raw) | stats sum(bytes) values(sourcetype) by host

View solution in original post

0 Karma

woodcock
Esteemed Legend

It is unclear but maybe you can get what you need from the Data Summary:

http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary

Other than that you can run a search like this:

index=* OR index=_* | eval bytes=len(_raw) | stats sum(bytes) values(sourcetype) by host
0 Karma

CryoHydra
Path Finder

| stats sum(len) ? or sum(bytes)

woodcock
Esteemed Legend

Another typo. Fixed.

0 Karma

ConnorG
Path Finder

What's the purpose of "index=* AND index=_*" ?

woodcock
Esteemed Legend

My bad, it should be OR, not AND. I fixed it.

0 Karma

vradhakrishnan
Engager

woodcock you query is what I was look for thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...