topic Re: status of data feeds coming in in Splunk Search

status of data feeds coming in

ecanmaster — Thu, 21 Dec 2017 08:11:50 GMT

Is there a way to show total feeds coming in per sourcetype etc. everyday?
Would be good if I can see the data within a graph, so we can see clearly fluctuations

Re: status of data feeds coming in

mayurr98 — Thu, 21 Dec 2017 08:30:59 GMT

Try this!

| tstats count where index=* by sourcetype _time | timechart span=1d count by  sourcetype

You can change span according to your need. run this for all time

Re: status of data feeds coming in

rvinjana — Thu, 21 Dec 2017 08:34:25 GMT

index=*
|timechart span=1d count by sourcetype

switch to visualization and see what chart suites you

Re: status of data feeds coming in

Elsurion — Thu, 21 Dec 2017 09:14:48 GMT

If you'd like to create a long time overview about your event inputs you can add the collected data to a summary.
I'm collecting here the events and the license usage for a yearly report 🙂
This saved search is run every hour to keep the load on the indexer small enough.

index=_internal sourcetype=splunkd group=per_sourcetype_thruput
| bucket span=1h _time
| stats sum(ev) as ev by series host _time
| rename series as sourcetype

| join type=left sourcetype
[ search index=_internal source=*license* type="Usage" 
| fields st, b, _time 
| bucket _time span=1h 
| stats sum(b) as b by st,_time 
| eval mb=round(b/1024/1024,3)
| rename st as sourcetype
]

| join type=left sourcetype
[
| eventcount summarize=false index=* index=_* | dedup index | fields index 
 | map maxsearches=100 search="|metadata type=sourcetypes index=\"$index$\" | eval index=\"$index$\""
 | fields index sourcetype
]
| eval index=if(isnull(index),"undefined",index)
| eval type="index_stats"
| fillnull value=0
| rename index as myindex, host as myhost, sourcetype as mysourcetype
| table _time, myindex, myhost, mysourcetype, ev, mb, b, type
| collect index=lic_summary

Re: status of data feeds coming in

nickhills — Thu, 21 Dec 2017 10:26:28 GMT

This is the search I use for exactly this purpose.

|tstats count AS tscount by sourcetype, _time|timechart max(tscount) by sourcetype useother=false

Re: status of data feeds coming in

DavidHourani — Thu, 21 Dec 2017 11:32:34 GMT

I downvoted this post because never use index=*

Re: status of data feeds coming in

nickhills — Thu, 28 Dec 2017 21:57:42 GMT

Hi - I added this post - If you find it useful, please upvote the answer, or add your own solution if you found another way!

https://answers.splunk.com/answers/606762/how-do-i-monitor-jbosstomcatapacheetc-and-raise-an.html

Re: status of data feeds coming in

ecanmaster — Fri, 29 Dec 2017 09:34:04 GMT

thx everyone for their feedback, the query I am using is this:

| tstats count WHERE index=* GROUPBY sourcetype, _time span=1d | timechart span=1d sum(count) by sourcetype

this seems to be working pretty good, but I can't filter sourcetypes that for example didnt receive any feeds for more than 24 hours

Re: status of data feeds coming in

gjanders — Sat, 30 Dec 2017 23:34:18 GMT

Meta Woot! might also help answer some of these questions...