topic Re: Message per second (MPS) in Getting Data In

Message per second (MPS)

jplaberge — Tue, 06 Jul 2010 00:55:46 GMT

How could we simply display how many messages (or events) Splunk receives/process per second (MPS : Message per second)?

Re: Message per second (MPS)

Lowell — Tue, 06 Jul 2010 01:49:35 GMT

You could try something like this:

index=_internal source=*metrics.log group="per_host_thruput" | timechart sum(eps)

These metrics are recorded every 30 seconds.

Re: Message per second (MPS)

splunklab2013 — Tue, 14 Jan 2014 06:56:51 GMT

Does it allow to change the throughput counts per second? If YES, then in what parameter i can change the values to change the count of messages received/processed per second by Splunk?

Re: Message per second (MPS)

MuS — Tue, 14 Jan 2014 07:27:12 GMT

Hi splunklab2013, you can limit forwards from sending too much data in limits.conf with this stanza:

[thruput]

maxKBps =
* If specified and not zero, this limits the speed through the thruput processor to the specified
rate in kilobytes per second.
* To control the CPU load while indexing, use this to throttle the number of events this indexer
processes to the rate (in KBps) you specify.

This must be set on the forwarder and not on the indexer!

Hope this helps, cheers MuS