Application support teams can get a snapshot of the volume of traffic on web servers to forecast spikes and future growth. Use the web access log files in the Splunk platform to calculate the total number of times the web server farm is accessed at a given time. Apply the Splunk platform's machine learning tools to forecast traffic based on the historical trends.
How to implement: This example use case depends on web server log data.
Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.
Data check: Run the following search to verify you are searching for normalized web data that is ready for this use case:
earliest=-1day index=* tag=web
| head 10
Predict the web traffic volume of your web applications based on the actual volume of traffic.
Run the following search.
| timechart count AS Hits
| predict future_timespan=30 Hits AS "Projected Hits"
If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.
For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.