topic Re: Why is daily EPS get less? in Splunk Search

Why is daily EPS get less?

Mien — Sun, 22 Oct 2023 13:59:58 GMT

Hi,

May I know, why is daily EPS on specific date get less than usually?

Is there any factor or cause to the less EPS count?

Thank you.

Re: Why is daily EPS get less?

gcusello — Sun, 22 Oct 2023 14:15:45 GMT

Hi @Mien ,

your question is just a little vague:

which days are you comparing?

which data source?

there could be many factors.

Ciao.

Giuseppe

Re: Why is daily EPS get less?

Mien — Mon, 23 Oct 2023 02:48:25 GMT

Hi @gcusello

For example, in a week, (average EPS). 18th Oct and 19th Oct got less than the actual. Meanwhile, on 15 Oct, 16 Oct, 17th Oct, 20th Oct and 21st Oct data looks normal.

The data source, /opt/splunk/var/log/splunk/metrics.log

Re: Why is daily EPS get less?

gcusello — Mon, 23 Oct 2023 06:09:34 GMT

Hi @Mien,

if the days in which you're receiving less data aren't the weekend, you should analyze if in that days there are some scheduled activities or a downtime of that systems.

In addition, you should analyze if this behaviour is all weeks or only in one.

then compare /opt/splunk/var/log/splunk/metrics.log file dimensions to understand if the issue is on Splunk or on the system.

Ciao.

Giuseppe