Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Forwaders hosts are also being displayed as comsumed data

$
0
0

Hi

I have used the following query to find indexer host wise mb consumed in indexeing.

index=_internal source=*metrics.log group=per_index_thruput series="Myindex" | eval MB=kb/1024 | stats sum(MB) by host | addcoltotals

but in this list i could see my forwarders hosts are also being displayed...and the Myindex is having almost double size of the data... can you pls help ?? wat needs to be checked to solve this problem ?


Viewing all articles
Browse latest Browse all 13053

Trending Articles