IRIS — Tracker & Transfer Health Tracker and transfer health with measured device peer captures. The device filter selects receivers in transfer panels and the named peer in tracker panels. All searches use the selected window; active tiles additionally require observations within the last 15 minutes from now. Telemetry last seen covers the full index. The peer chart groups cumulative captures by capture hour, not throughput. Missing captures are unavailable; incomplete captures give partial totals and a percentage with unknown bias.

Time window -24h now Device / receiver (* = all; wildcards allowed) *

index=iris_logs "iris.peer.role"=* | eval Peer=replace('iris.principal',"^device:","") | search Peer=$dev|s$ | stats latest("iris.peer.role") as Role latest(_time) as Seen by Peer "iris.torrent.info_hash" | where Seen>=relative_time(now(),"-15m") AND Role="seeder" | stats dc(Peer) as Seeders $tr.earliest$ $tr.latest$ none value ["0x53a051","0x53a051"] index=iris_logs "iris.peer.role"=* | eval Peer=replace('iris.principal',"^device:","") | search Peer=$dev|s$ | stats latest("iris.peer.role") as Role latest(_time) as Seen by Peer "iris.torrent.info_hash" | where Seen>=relative_time(now(),"-15m") AND Role="leecher" | stats dc(Peer) as Leechers $tr.earliest$ $tr.latest$ none value [0] ["0x53a051","0xf8be34"] Average elapsed download time per completed device transfer, from aria2 submission to its last-piece completion hook (one-second resolution). Includes download waiting/pauses; excludes subsequent checksum and copying. Requires updated agents and measured endpoints; already-present images and unmeasured transfers are excluded. Reports received in the selected time window are deduplicated by device and transfer. index=iris_logs "otel.log.name"="iris.device.transfer.report" "iris.download.duration_seconds"=* | search "device.id"=$dev|s$ | stats latest("iris.download.duration_seconds") as Seconds by "device.id" "iris.transfer.id" | where isnotnull(Seconds) AND Seconds>=0 | stats avg(Seconds) as Seconds | eval "Average minutes"=round(Seconds/60,1) | fields "Average minutes" $tr.earliest$ $tr.latest$ none min index=iris_logs | stats latest(_time) as Last | eval "Seconds ago"=round(now()-Last,0) | fields "Seconds ago" $tr.earliest$ $tr.latest$ none sec ago value [60,300] ["0x53a051","0xf8be34","0xdc4e41"] index=iris_logs "iris.peer.role"=* | eval Peer=replace('iris.principal',"^device:","") | search Peer=$dev|s$ | bin _time span=5m | stats latest("iris.peer.role") as Role by _time Peer "iris.torrent.info_hash" | chart dc(Peer) over _time by Role $tr.earliest$ $tr.latest$ line devices bottom {"seeder":0x53A051,"leecher":0xF8BE34} One-minute averages for the whole fleet; the device filter does not apply. Device receive/send rates sum fresh reporting devices; updated agents also sample completed seeders. Missing reports and transfers between agent ticks are not measured. Distribution Server sent is sampled independently. Do not subtract these lines to infer peer traffic: timing and coverage differ. Use the captured peer-byte panels for measured device-to-device totals. | mstats avg(_value) AS v WHERE index=iris_metrics metric_name="iris.transfer.throughput" BY "network.io.direction","iris.torrent.info_hash" span=1m | eval Series=if('network.io.direction'=="transmit","Sent device to device","Received by devices") | append [ | mstats avg(_value) AS v WHERE index=iris_metrics metric_name="iris.seeder.torrent.upload_rate" BY "iris.torrent.info_hash" span=1m | eval Series="Distribution Server sent" ] | eval MBps=v/1048576 | timechart span=1m sum(MBps) by Series $tr.earliest$ $tr.latest$ line MiB/s (1-minute sampled average) gaps bottom index=iris_logs "otel.log.name"="iris.device.transfer.report" | search "device.id"=$dev|s$ | stats latest("iris.transfer.bytes_from_devices_total") as Devices latest("iris.transfer.bytes_from_origin_total") as Origin latest("iris.transfer.bytes_from_unknown_total") as Unknown latest("iris.transfer.bytes_unattributed_omitted") as Omitted by "iris.transfer.id" | stats sum(Devices) as Devices sum(Origin) as Origin sum(Unknown) as Unknown sum(Omitted) as "Untraced capped rows" | transpose 0 header_field=column | rename "row 1" as Bytes, column as Source | eval "Received GB"=round(Bytes/1024/1024/1024,2) | fields Source "Received GB" $tr.earliest$ $tr.latest$ bar GB none index=iris_logs "iris.peer.role"=* | eval Device=replace('iris.principal',"^device:","") | search Device=$dev|s$ | stats earliest(eval(if('iris.peer.role'="leecher",_time,null()))) as Started earliest(eval(if('iris.peer.role'="seeder",_time,null()))) as Seeded by Device "iris.torrent.info_hash" | where isnotnull(Started) AND isnotnull(Seeded) AND Seeded>=Started | eval "Minutes to seed"=round((Seeded-Started)/60,1), Started=strftime(Started,"%F %T"), Seeded=strftime(Seeded,"%F %T") | rename "iris.torrent.info_hash" as Torrent | table Device Torrent Started Seeded "Minutes to seed" | sort - "Minutes to seed" $tr.earliest$ $tr.latest$ none20 index=iris_logs "otel.log.name"="iris.device.transfer.report" | search "device.id"=$dev|s$ | where 'iris.transfer.content_sha256.state'!="verified" OR 'iris.transfer.ios_copy_verify.state'!="ok" | stats latest(_time) as Seen latest("iris.report.event") as Stage latest("iris.image.id") as Image latest("iris.transfer.content_sha256.state") as Checksum latest("iris.transfer.ios_copy_verify.state") as "Copy verify" by "device.id" | eval Seen=strftime(Seen,"%F %T") | rename "device.id" as Device | table Seen Device Image Stage Checksum "Copy verify" | sort - Seen $tr.earliest$ $tr.latest$ none20 index=iris_logs ("iris.peer.role"=* OR "iris.image.id"=*) | eval Device=coalesce('device.id',replace('iris.principal',"^device:","")) | search Device=$dev|s$ | rename "iris.peer.role" as PeerRole, "iris.image.id" as ImageId | stats latest(PeerRole) as Role latest(eval(if(isnotnull(PeerRole),_time,null()))) as RoleSeen latest(ImageId) as Image by Device | where RoleSeen>=relative_time(now(),"-15m") | eval "Device type"=case(like(Image,"c8000v%"),"Catalyst 8000V",like(Image,"8000-%"),"Cisco 8000 / IOS XR",like(Image,"cat9k%"),"Catalyst 9000",like(Image,"ie3x00%"),"IE 3000",true(),"Unclassified") | chart dc(Device) over "Device type" by Role $tr.earliest$ $tr.latest$ bar stacked active devices bottom {"seeder":0x53A051,"leecher":0xF8BE34} Cumulative bytes each device reported receiving, grouped by the selected capture's hour and stacked by who sent them: origin (the seeder), peer device (another IRIS device), unknown (a peer the server could not name — a normal outcome, not an error). A visible "peer device" band is the direct evidence that peer-to-peer distribution carried load. Report pulls do not add bytes. These capture totals are not an hourly traffic rate, and an empty bucket is not proof of zero traffic. index=iris_logs source=iris sourcetype=otel:logs "otel.log.name"="iris.device.peer_transfer_record" | dedup "event.id" | eval received_bytes=tonumber('iris.transfer.session_bytes_from_peer') | sort 0 -received_bytes | dedup "device.id" "iris.image.id" "iris.transfer.id" "network.peer.address" | search "device.id"=$dev|s$ | eval source=case('iris.peer.attribution'=="origin","origin",'iris.peer.attribution'=="device","peer device",1==1,"unknown") | eval MiB=received_bytes/1048576 | timechart span=1h sum(MiB) BY source $tr.earliest$ $tr.latest$ column stacked MiB received, by capture hour zero bottom none index=iris_logs source=iris sourcetype=otel:logs "otel.log.name"="iris.device.peer_transfer_record" | dedup "event.id" | eval received_bytes=tonumber('iris.transfer.session_bytes_from_peer') | sort 0 -received_bytes | dedup "device.id" "iris.image.id" "iris.transfer.id" "network.peer.address" | search "device.id"=$dev|s$ | eval b=received_bytes | stats sum(eval(if('iris.peer.attribution'=="device",b,null()))) AS peer_bytes, sum(b) AS all_bytes | eval pct=if(isnull(all_bytes) OR all_bytes<=0,null(),round(100*coalesce(peer_bytes,0)/all_bytes,1)) | fields pct $tr.earliest$ $tr.latest$ none % Captured peer bytes ÷ all captured bytes (origin and unknown included) 0.0 Receiving-device filter; Sender names the other device. Capture time is when the cumulative counters were read, not when every byte arrived. A false completeness flag means peers may be missing. index=iris_logs source=iris sourcetype=otel:logs "otel.log.name"="iris.device.peer_transfer_record" | dedup "event.id" | eval received_bytes=tonumber('iris.transfer.session_bytes_from_peer') | sort 0 -received_bytes | dedup "device.id" "iris.image.id" "iris.transfer.id" "network.peer.address" | where 'iris.peer.attribution'=="device" | search "device.id"=$dev|s$ | eval "Bytes from this peer"=received_bytes | eval "MiB from this peer"=round(received_bytes/1048576,1) | eval Image=coalesce('iris.image.name','iris.image.id') | rename "iris.peer.device_id" AS Sender, "device.id" AS Receiver, "iris.transfer_record.capture_complete" AS "Capture complete" | table _time, Sender, Receiver, Image, "Bytes from this peer", "MiB from this peer", "Capture complete" | sort - _time | head 100 | appendpipe [ stats count AS n | where n==0 | eval Sender="— no device-to-device peer transfer records in this window (none captured, which is not the same as none happened) —" | fields Sender ] $tr.earliest$ $tr.latest$ none25