how to create an alert for any forwarders that are reaching max throughput consistently?
index=_internal source="*splunkd.log" | eval KBps=tcp_Bps/1024 | stats sum(KBps) as throughput by host | where throughput > 5000 This gives who sum of the throughput for an entire day but i need me exactly which forwarders are throttling
↧