Splunk Search

Is there a metric search to define how many times load balanced forwarders switch indexers?

asabatini85
Path Finder

Hi Everyone,

Is there a metric Search to define how many times load balanced forwarders switch indexers?

Thank you.

0 Karma
1 Solution

asabatini85
Path Finder

I did this search by my self

index=_internal source=metrics.log "group=tcpin_connections" host=ip-10-0-163 | eval sourceHost=if(isnull(hostname), sourceHost,hostname)
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| eval version=if(isnull(version),"pre 4.2",version)
| rename version as Ver
| fields connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver
| eval Indexer= splunk_server
| eval Date=strftime(_time,"%d-%m-%Y %H:%M:%S")
| search connectType="heavy fwder"
| sort - _time
| streamstats count, range(_time) as duration min(_time) as min_time, max(_time) as max_time sum(tcp_Kprocessed) as kb_processed, sum(tcp_eps) as tcp_eps by sourceIp destPort Indexer
| eval mb_processed=kb_processed/1024
| eventstats min(mb_processed) as min_mb avg(mb_processed) as avg_mb max(mb_processed) as max_mb
| table count sourceIp, Indexer ,duration, tcp_eps mb_processed destPort min_mb max_mb avg_mb

View solution in original post

asabatini85
Path Finder

I did this search by my self

index=_internal source=metrics.log "group=tcpin_connections" host=ip-10-0-163 | eval sourceHost=if(isnull(hostname), sourceHost,hostname)
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| eval version=if(isnull(version),"pre 4.2",version)
| rename version as Ver
| fields connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver
| eval Indexer= splunk_server
| eval Date=strftime(_time,"%d-%m-%Y %H:%M:%S")
| search connectType="heavy fwder"
| sort - _time
| streamstats count, range(_time) as duration min(_time) as min_time, max(_time) as max_time sum(tcp_Kprocessed) as kb_processed, sum(tcp_eps) as tcp_eps by sourceIp destPort Indexer
| eval mb_processed=kb_processed/1024
| eventstats min(mb_processed) as min_mb avg(mb_processed) as avg_mb max(mb_processed) as max_mb
| table count sourceIp, Indexer ,duration, tcp_eps mb_processed destPort min_mb max_mb avg_mb

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...