Dashboard - Indexer Data Spread Indexer Data Spread

-24h@h now Time for the indexed data per KB per second -24h@h now

| tstats count WHERE index="*" by splunk_server _time span=10m | timechart span=10m sum(count) by splunk_server $thetime.earliest$ $thetime.latest$ 1 ellipsisNone 0 visible visible visible linear linear 0 inherit area 50 10 area gaps none 0.01 stacked100 shiny all 0 0 ellipsisMiddle right (index=_internal `indexerhosts` `splunkadmins_metrics_source` sourcetype=splunkd group=thruput name=index_thruput) | eval ingest_pipe = if(isnotnull(ingest_pipe), ingest_pipe, "none") | search ingest_pipe=* | timechart minspan=30s per_second(kb) by host $time_tok.earliest$ $time_tok.latest$ 1 ellipsisNone 0 visible visible visible linear linear 0 inherit area 50 10 area gaps minmax 0.01 stacked shiny all 0 0 ellipsisMiddle right index=_internal sourcetype=splunkd group=tcpin_connections (connectionType=cooked OR connectionType=cookedSSL) fwdType=* guid=* `indexerhosts` | timechart minspan=30s dc(guid) as forwarder_count, per_second(kb) as tcp_KBps | rename forwarder_count as "Forwarder Count", tcp_KBps as "Throughput (KB/s)" $time_tok.earliest$ $time_tok.latest$ 1 ellipsisNone 0 visible visible visible linear linear 1 inherit column 50 10 area gaps "Throughput (KB/s)" none 0.01 stacked shiny all 0 0 ellipsisMiddle right index=_internal `indexerhosts` `splunkadmins_metrics_source` sourcetype=splunkd group=queue name=splunktcpin OR name=tcpin_cooked_pqueue | eval max=if(isnotnull(max_size_kb),max_size_kb,max_size) | eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size) | eval fill_perc=round((curr/max)*100,2) | timechart minspan=30s Median(fill_perc) AS "fill_percentage" by host $time_tok.earliest$ $time_tok.latest$ 1 ellipsisNone 0 visible collapsed visible linear 100 linear 0 inherit area 50 10 area gaps none 0.01 default shiny all 1 0 ellipsisMiddle right