Example of how to monitor log volume trends?

sloshburch — Wed, 20 Nov 2019 16:37:00 GMT

Does anyone have examples of how to use Splunk to monitor log volume trends?

Re: Example of how to monitor log volume trends?

sloshburch — Wed, 20 Nov 2019 16:37:36 GMT

The Splunk Product Best Practices team helped produce this response. Read more about use case examples Splunk® Platform Use Cases on Splunk Docs.

This use case enables analysts and application developers to monitor trends in the number of events being logged by an application, which can indicate the state of your application and/or changes in behavior of your code or environment.

This use case is from the Splunk Essentials for Infrastructure Troubleshooting and Monitoring app. For more examples, see the Splunk Essentials for Infrastructure Troubleshooting and Monitoring on Splunkbase.

Load data

How to implement: Ingest application, operating system, microservices, virtualization, and/or network logs into Splunk Enterprise. Summarize the event count over time using the timechart command. Leverage any fields that provide useful split by fields present in your logs, such as host, response code, or log level.

Data check: This use case depends on application, operating system, microservices, virtualization, or network logs. For best results, add the desired sources, source types, hosts, or indexes to the first line of the base search.

Get insights

Baseline and analyze log volume trends in your applications to monitor their relative health using the timechart command and split by fields present in your logs, such as host, response code, or log level. Analysts and application developers can inve

Use the following search:

index=*

| timechart limit=0 partial=false span=1m count BY host

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, deploy the Add-ons to the search heads to access the knowledge objects necessary for simple searching. See About installing Splunk add-ons on Splunk Docs for assistance.

For more support, post a question to the Splunk Answers community.

Re: Example of how to monitor log volume trends?

sloshburch — Mon, 09 Dec 2019 17:33:18 GMT

Update: I added a related video.

topic Re: Example of how to monitor log volume trends? in Deployment Architecture

Example of how to monitor log volume trends?

Re: Example of how to monitor log volume trends?

The Splunk Product Best Practices team helped produce this response. Read more about use case examples Splunk® Platform Use Cases on Splunk Docs.

Load data

Get insights

Help

Re: Example of how to monitor log volume trends?