Installation

How do you check transfer speed from universal forwarder to indexer by event or file?

human96
Communicator

how to check the transfer speed from UF to indexer ?

 

is it possible to check by events or source ?

Labels (2)
0 Karma

human96
Communicator

From my prospective , i believe  the indexing speed by source, sourcetype, host, or index can be calculated  using the below SPL or the search query.

index="_internal" source="*metrics.log" per_source_thruput series=ps | eval MB=kb/1024 | timechart span=5m sum(MB) by series

0 Karma

gcusello
Esteemed Legend

Hi @human96,

probably your search is correct, even if i don't exactly understand what't your Use Case, what's series?

and generally, why invent hot water?

in the Monitorinbg Console you have all the searches to calculate all the needed metrics (indexing speed, license consuption, etc...).

I'd prefer a standard solution, but you could also use your search.

Tell me if I can help you more.

Ciao and happy splunking.

Giiuseppe

P.,S.: Karma Points are appreciated 😉

gcusello
Esteemed Legend

Hi @human96,

using the Monitoring Console, you have all the information about data logs tranferred from each UF to Indexers.

[Settings -- Monitoring Console -- Forwarders]

If you don't have, you have to configure Monitoring Console to monitor UFs in [Settings -- Monitoring Console -- Settings -- Forwarders Monitoring Setup].

Ciao.

Giuseppe

human96
Communicator

thanks for the quick response @gcusello , really appreciate this.
can we also check  by event or file (source)?

Will really appreciate if you could attach the splunk documentation.

0 Karma

gcusello
Esteemed Legend

Hi @human96,

in the Monitoring Console, you have the traffic for each client sending logs.

If you want to knopw the weight of each file, you should count the chars of earch source.

You can find documentation about Monitoring Console at https://docs.splunk.com/Documentation/Splunk/8.2.4/DMC/DMCoverview

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...