Data Volume/Client


is it possible to see which metrics are causing high data volume send per client? Under Licesing/Volume I can see the MB sum of each Client and a sum of each metric for the whole environment. but not detailed for each client.


1 comment

  • Avatar
    Timm Brochhaus Official comment

    Hi Gerald, 

    The information you are looking for is not part of uberAgent's default dashboards. 

    Would you please run the following Splunk search? Hopefully, this custom search meets your requirements. 

    idx=`uberAgent_index` idx!=uberagent_log idx!=ua_meta*
    | lookup lookup_uA_sourcetypes_metrics Sourcetype as st OUTPUTNEW uAMetric as "uberAgent metric" uAProduct as "uberAgent product"
    | stats
    sum(b) as SumBytes
    by h "uberAgent metric" "uberAgent product"
    | eventstats sum(SumBytes) as TotalBytes
    | eval "Data volume (MB)" = round (SumBytes / 1048576, 2)
    | eval "Data volume (%)" = round (SumBytes / TotalBytes * 100, 2)
    | rename h as Host
    | sort - "Data volume (MB)"
    | table
    "uberAgent metric"
    "uberAgent product"
    "Data volume (MB)"
    "Data volume (%)"
Please sign in to leave a comment.