Hi,
Below is the query i am using to find the forwarders sending more data than others for a specific sourcetype
index=index-name sourcetype=sourcetype-name | stats count by host | sort - count
is the above query correct ?
Firstly, I would use a tstats for this (using only metadata fields) type of queries.
| tstasts count WHERE index=index-name sourcetype=sourcetype-name by host | sort - count
Second, when you say more data, it could be more number of events or more amount of data being sent. You got the query for number of events. For amount of data, you would need to user license usage logs, something like this
index=_internal source=*license_usage.log type=Usage idx=index-name st=sourcetype-name | stats sum(b) as usage by h | sort -usage
Hi kteng,2024
| stats count will give you count of events but not how large the events are.
considering each forwarder is on a host and you would like to see which host sends the most data (in volume not count) you can look at the license master. here's a sample search to run manually as well:
earliest=-1d@d latest=@d index=_internal source=license_usage.log type=Usage
| stats sum(b) AS Bytes by h
| eval GB = Bytes/1024/1024/1024
| table h GB
| sort -GB
| addcoltotals
you can play with earliest and latest to pick your time or just puse time picker
you can also filter by other parameters then h
i = index
h = host
st = sourcetype
Cheers