topic peak time of log sources in Splunk Search

peak time of log sources

lohit — Thu, 24 Oct 2013 12:26:12 GMT

Hi ,

I have some forwarders installed in my environment and want to calculate the peak time in which log sources forwarded the logs. I have around 15 Universal forwarders installed and looking to create a unified report for all the log sources peak time.(hourly basis). for example If my Log Source A, has send the maximum no of logs between 2-3 pm. SOme thing of that sort.

I would greatly appreciate any help.!!

Regards
Lohit

Re: peak time of log sources

davebrooking — Mon, 28 Sep 2020 15:03:41 GMT

Lohit

You could use the license usage logs, something like the following will show how much is being indexed by each UF over time.

index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024| rename h as host | timechart span=1h sum(MB) AS IndexedMB by host

Dave

Re: peak time of log sources

lohit — Thu, 24 Oct 2013 13:09:29 GMT

the above command shows the usage of all the forwarder in a particular time frame. I was looking for only the the follwoing format

Source Peak Time Amount of Logs

Re: peak time of log sources

lohit — Thu, 24 Oct 2013 13:18:09 GMT

Also i am just looking in timeframe of 1hr(full 24 hrs) of previous day only.

Re: peak time of log sources

lukejadamec — Thu, 24 Oct 2013 14:20:27 GMT

You can use this to show the count (rough estimate of volume) by source:

index="*" source="*" host="*" |timechart span=1h count by source useother=false limit=50

Or, you can use this to show the count (rough estimate of volume) by host:

index="*" source="*" host="*" |timechart span=1h count by host useother=false limit=15

Use the buttons in the upper left to switch between chart and table view.

You can try this to show the count by hour, host, and source, but there is too much data for the chart.

index="*" source="*" host="*" | bucket _time span=1h |stats count by date_hour,host,source

Re: peak time of log sources

jtrucks — Thu, 24 Oct 2013 15:36:12 GMT

You can change the initial search to match what you need, but this works to get the top value, with 1h buckets, per host:

earliest="-1d@d" latest="-0d@d" index=_internal source=*license_usage.log type=Usage s="mylogsourcenamehere" | eval GB=b/1024/1024/1024 | bucket span=1h _time | stats sum(GB) AS GBsum by _time,h | sort -GBsum,h | dedup h

Enjoy.
Jesse