Getting Data In

Indexed Data Volume from Windows Event Colector

imoskal
Engager

Hi,
There Windows Event Collector, which collects data from multiple Windows servers. Splunk forwarder installed on the server running this collector transmits the data to the Splunk server . How can I calculate the indexed data volume each windose servers that are going to a collector?

0 Karma
1 Solution

kristian_kolb
Ultra Champion

So you have a field in each event (ComputerName) that contains the information of the originating machine.

 ... | eval kb=(len(_raw) / 1024) | stats sum(kb) by ComputerName | ...

Will this work?

/K

View solution in original post

kristian_kolb
Ultra Champion

So you have a field in each event (ComputerName) that contains the information of the originating machine.

 ... | eval kb=(len(_raw) / 1024) | stats sum(kb) by ComputerName | ...

Will this work?

/K

imoskal
Engager

Yes, this works! Thank you very much!

0 Karma

imoskal
Engager

Yes, it is Windows Event Logs.
They look like this:
4/12/13
3:56:42.000 PM

04/12/2013 03:56:42 PM
LogName=Application
SourceName=Office Software Protection Platform Service
EventCode=1003
EventType=4
Type=Information
ComputerName=ENERGOSERVISSQL.********.com
TaskCategory=None
OpCode=None
RecordNumber=11649

0 Karma

kristian_kolb
Ultra Champion

Are you talking about Windows Event Logs (application, security, system)?

Does this collection of events alter the messages in some way, or do they look like 'ordinary' events? Do they in any way contain information of what host they originated from?

0 Karma

gfuente
Motivator

Hello

You can use the SOS app:

http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk

It will tell you the indexed data by host

Regards

0 Karma

imoskal
Engager

Sorry - I can not. In this case, the "host" - is the server on which the forwarder and the collector. In the event field with the name server is called "ComputerName". I can not make a search in which each field "ComputerName" were in line with an index for the amount of data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...