topic Re: Calculating Source type info indexing rate and EPS in Splunk Search

Calculating Source type info indexing rate and EPS

Splunk_rocks — Mon, 19 Mar 2018 13:30:37 GMT

Hello Splunkers,

I would like to calculate below EPS values for 30 days time period for each source type on one combined search and i have individual searches but just want to see if i can get some thing here.

Average Event Size EPS (KBPS)
Max EPS (KBPS)
Average EPS (KB)
General EPS (KB)

Re: Calculating Source type info indexing rate and EPS

damiensurat — Tue, 29 Sep 2020 18:32:09 GMT

If you're running the latest version, some of that info is on the Index Activity dashboard, and you can use that search as a start.

Change out the calc for measuring max, min, avg, etc
EG:
timechart avg(kbps) by series
timechart max(kbps) by series

kbps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(kbps) by series

eps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(eps) by series

If you wanted host or source, use group="per_source_thruput" or group="per_host_thruput" instead.

ah, one more suggestion... If you don't want to chart the results in a timeseries, you can swap out the timechart command with the stats command which may be a better fit for the solution you are looking for:

EG:
index="_internal" source=*metrics.log group="per_sourcetype_thruput" | stats avg(eps) by series

Re: Calculating Source type info indexing rate and EPS

Splunk_rocks — Mon, 19 Mar 2018 15:27:10 GMT

Thanks but i dont have access to DMC so that is why im looking for individual searches .

Re: Calculating Source type info indexing rate and EPS

Splunk_rocks — Mon, 19 Mar 2018 15:46:28 GMT

I just need calculate index=* sourcetype=* not from internal index

Re: Calculating Source type info indexing rate and EPS

damiensurat — Mon, 19 Mar 2018 16:26:40 GMT

Use tstats and specify the variables:

• index=main
• earliest=-30d
• groupby (_time, sourcetype)
• span=1s

| tstats count as COUNT where index=main earliest=-30d by _time,sourcetype span=1s | timechart span=1h max(COUNT) as eps by sourcetype useother=f