Knowledge Management

How to determine the data volume associated to a group of hosts?

olopez77
Explorer

I have data comming into the corporate indexers from several business units (BU). Given a list of hosts owned by each BU, how do you determine how much data volume is associated to each BU?

Tags (1)
0 Karma

vincesesto
Communicator

Hey olopez77,

Have you checked out the Splunk License Usage app that is available:
http://splunk-base.splunk.com/apps/22382/splunk-license-usage

I think this should give you a good idea as to how you can set this up...One of the searches being performed on the dashboard does something like the following:

index="_internal" source="metrics.log" per_host_thruput | chart sum(kb) by series

So all you would really need to do is provide host details for each BU and you can get a total from that.

Hope that this helps, if not let me know and I would be happy to clarify.

Regards Vince

0 Karma

olopez77
Explorer

I'm not clear on how to "provide host details", I currently have over 22k hosts sending data. Each BU contributes data from several hundred hosts. The goal is to provide each BU a breakdown of how much volume each BU generates. I only have host lists (csv) to work from. Unfortunately, I have no mechanism in Splunk (i.e. tags, or dedicated indexes) that associate hosts to a BU.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...