All Apps and Add-ons

Example of how to use wire data to find issues with application performance?

sloshburch
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk to use wire data to find issues with application performance?

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application and IT admins can find user problems you can't find with application logs or APM tools alone by using Splunk Stream, a solution that delivers real-time visibility into applications and infrastructure without the need for code instrumentation. Correlate Splunk Stream data with other application and infrastructure data (such as logs, metrics and events) and gain a better view of availability, performance and usage of your services. This example use case focuses on database queries that are taking the longest time so you can tune database queries in the application, or optimize database tables to improve performance. For more about Splunk Stream and how to use it, see About Splunk Stream.

Load data

How to implement: This example use case depends on streams of network event data.

Install Splunk Stream and correlate that data with the other data you are already collecting. Find Splunk Stream on Splunkbase. Follow the instructions for how to configure Splunk Stream to capture database streams. For a list of the database protocols Splunk Stream supports, see Database protocols in the Splunk Stream Installation and Configuration manual. For instructions about where to install the components, including the bundled Splunk_TA_stream to your search head, see Splunk Stream deployment architectures in the Splunk Stream Installation and Configuration manual.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Data check: Run the following search to verify you are searching for normalized database data that is ready for this use case:

earliest=-1day index=* tag=database
| head 10

Get insights

Use wire data collected through Splunk Stream to find issues with application performance that you can't find using application logs or APM tools.

Run the following search.

index=* tag=database tag=query query!=""
| eval time_per_byte = duration / bytes
| stats avg(time_per_byte) AS average-time_per_byte BY query
| sort - average-time_per_byte

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application and IT admins can find user problems you can't find with application logs or APM tools alone by using Splunk Stream, a solution that delivers real-time visibility into applications and infrastructure without the need for code instrumentation. Correlate Splunk Stream data with other application and infrastructure data (such as logs, metrics and events) and gain a better view of availability, performance and usage of your services. This example use case focuses on database queries that are taking the longest time so you can tune database queries in the application, or optimize database tables to improve performance. For more about Splunk Stream and how to use it, see About Splunk Stream.

Load data

How to implement: This example use case depends on streams of network event data.

Install Splunk Stream and correlate that data with the other data you are already collecting. Find Splunk Stream on Splunkbase. Follow the instructions for how to configure Splunk Stream to capture database streams. For a list of the database protocols Splunk Stream supports, see Database protocols in the Splunk Stream Installation and Configuration manual. For instructions about where to install the components, including the bundled Splunk_TA_stream to your search head, see Splunk Stream deployment architectures in the Splunk Stream Installation and Configuration manual.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Data check: Run the following search to verify you are searching for normalized database data that is ready for this use case:

earliest=-1day index=* tag=database
| head 10

Get insights

Use wire data collected through Splunk Stream to find issues with application performance that you can't find using application logs or APM tools.

Run the following search.

index=* tag=database tag=query query!=""
| eval time_per_byte = duration / bytes
| stats avg(time_per_byte) AS average-time_per_byte BY query
| sort - average-time_per_byte

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...