All Apps and Add-ons

License Use Search Question

hartfoml
Motivator

I have a number of Linux systems that are reporting to the OS index

I need to move to an Organizational index

I can do this using the deployment server since they are all reporting to the DS

The organization is being charged by the amount of data they put in there index each day

I have a list of hosts [index=os host=server1 OR host=server2 OR host=server3 OR host=etc]

What would be the best way to fashion a search to see how much data per day will be added to the ORG index whan I move the 93 systems to the new index?

0 Karma
1 Solution

lukejadamec
Super Champion

Here is one of my all time favorite searches:

index=_internal source=*metrics.log group=per_index_thruput series=ORG | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)

Change the series to what ever index you're looking for, or a number of indexes if you like, and run it for the time period you'd like to check.

EDIT:

Getting a pre-move estimate is rather tricky, because a host can write to more than one index. If you assume that the hosts you're moving only write to the OS index, then you can use this search for per_host_thruput.

index=_internal source=*metrics.log group=per_host_thruput series=hostA OR series=hostb OR series=hostc | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)

You may be able to group your hosts by similar names, or use a lookup.

View solution in original post

0 Karma

lukejadamec
Super Champion

Here is one of my all time favorite searches:

index=_internal source=*metrics.log group=per_index_thruput series=ORG | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)

Change the series to what ever index you're looking for, or a number of indexes if you like, and run it for the time period you'd like to check.

EDIT:

Getting a pre-move estimate is rather tricky, because a host can write to more than one index. If you assume that the hosts you're moving only write to the OS index, then you can use this search for per_host_thruput.

index=_internal source=*metrics.log group=per_host_thruput series=hostA OR series=hostb OR series=hostc | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)

You may be able to group your hosts by similar names, or use a lookup.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!