https://community.splunk.com/t5/Getting-Data-In/Chart-indexed-events-per-second-over-time/m-p/71618#M14593 <P>You cannot use metrics.log's "per_sourcetype_thruput" for this because it only samples the top 10 busiest source types for every capture period of 30s.</P> <P>To accurately measure the rate of indexing of a given source type over time, you'd have to go to the events themselves and cursor your search using _indextime instead of _time, like so:</P> <PRE><CODE>index=cisco sourcetype="cisco_asa" | eval _time = _indextime | bin _time span=30m | stats count by _time | timechart span=30m per_second(count) AS EPS </CODE></PRE> Mon, 28 Sep 2020 14:09:47 GMT hexx 2020-09-28T14:09:47Z https://community.splunk.com/t5/Getting-Data-In/Chart-indexed-events-per-second-over-time/m-p/71617#M14592 <P>How can I use this to make a chart and graph over a 7 day period (for example) without running it in realtime? I want to be able to see the eps for a sourcetype so I can make an alert when a threshold is reached. I tried using:</P> <PRE><CODE>index="_internal" (source=*metrics.log) group="per_sourcetype_thruput" series="cisco_asa" | timechart span=30m max(eps) </CODE></PRE> <P>But this doesn't match up with another system I am using especially when a spike occurs.</P> Fri, 21 Jun 2013 20:28:10 GMT https://community.splunk.com/t5/Getting-Data-In/Chart-indexed-events-per-second-over-time/m-p/71617#M14592 dslevy 2013-06-21T20:28:10Z https://community.splunk.com/t5/Getting-Data-In/Chart-indexed-events-per-second-over-time/m-p/71618#M14593 <P>You cannot use metrics.log's "per_sourcetype_thruput" for this because it only samples the top 10 busiest source types for every capture period of 30s.</P> <P>To accurately measure the rate of indexing of a given source type over time, you'd have to go to the events themselves and cursor your search using _indextime instead of _time, like so:</P> <PRE><CODE>index=cisco sourcetype="cisco_asa" | eval _time = _indextime | bin _time span=30m | stats count by _time | timechart span=30m per_second(count) AS EPS </CODE></PRE> Mon, 28 Sep 2020 14:09:47 GMT https://community.splunk.com/t5/Getting-Data-In/Chart-indexed-events-per-second-over-time/m-p/71618#M14593 hexx 2020-09-28T14:09:47Z