Installation

How do you check transfer speed from universal forwarder to indexer by event or file?

human96
Communicator

how to check the transfer speed from UF to indexer ?

 

is it possible to check by events or source ?

Labels (2)
0 Karma

human96
Communicator

From my prospective , i believe  the indexing speed by source, sourcetype, host, or index can be calculated  using the below SPL or the search query.

index="_internal" source="*metrics.log" per_source_thruput series=ps | eval MB=kb/1024 | timechart span=5m sum(MB) by series

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @human96,

probably your search is correct, even if i don't exactly understand what't your Use Case, what's series?

and generally, why invent hot water?

in the Monitorinbg Console you have all the searches to calculate all the needed metrics (indexing speed, license consuption, etc...).

I'd prefer a standard solution, but you could also use your search.

Tell me if I can help you more.

Ciao and happy splunking.

Giiuseppe

P.,S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @human96,

using the Monitoring Console, you have all the information about data logs tranferred from each UF to Indexers.

[Settings -- Monitoring Console -- Forwarders]

If you don't have, you have to configure Monitoring Console to monitor UFs in [Settings -- Monitoring Console -- Settings -- Forwarders Monitoring Setup].

Ciao.

Giuseppe

human96
Communicator

thanks for the quick response @gcusello , really appreciate this.
can we also check  by event or file (source)?

Will really appreciate if you could attach the splunk documentation.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @human96,

in the Monitoring Console, you have the traffic for each client sending logs.

If you want to knopw the weight of each file, you should count the chars of earch source.

You can find documentation about Monitoring Console at https://docs.splunk.com/Documentation/Splunk/8.2.4/DMC/DMCoverview

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...