I am using the following command which gives me what I am looking for regarding a single indexer, but I would like a table listing all my indexers and heavy forwarders and the average tcp_KBps. I am trying to determine any network impact with and without compression.
index=_internal host=* source="*metrics.log*" destIp=REDACTED.* component=Metrics group=tcpout_connections | timechart avg(tcp_KBps) AS avg_KBps
HOST Average KBps
indexer-a 400.33333
indexer-b 8000.9999
syslog-a 500.33333
syslog-b 1000.55555
...
Try this. You may need to add a where
clause to filter out non-indexer data.
index=_internal host=* source="*metrics.log*" destIp=* component=Metrics group=tcpout_connections
| timechart avg(tcp_KBps) AS avg_KBps by destIp