Archive

Hi, please help me asap if possible. I'm using splunk could and having access to search head. Is there any search query to find out indexing and EPS rate.

Rody333
New Member

I'm using splunk could and having access to search head. Is there any search query to find out indexing and EPS rate.

Tags (1)
0 Karma

elliotproebstel
Champion

Here are some queries supplied by @martin_mueller in an older post.

 index=_internal component=metrics TERM(group=thruput) | timechart per_second(ev) by splunk_server
 index=_internal component=metrics TERM(group=thruput) | timechart avg(instantaneous_eps) by splunk_server

He suggests that the two may produce very different metrics if your server isn't on all day.

elliotproebstel
Champion

Have you had a chance to try these queries? Did they work for you?

0 Karma

Rody333
New Member

Yes, I got results. Just to confirm: 1st query is to get indexing rate in kbps and 2nd query is to get "event per second'. Please correct me.

0 Karma

elliotproebstel
Champion

According to @martin_mueller, both of these should be outputting events per second.

0 Karma

Rody333
New Member

okay, but both giving different results like 1st query giving 200,210 etc and 2nd query giving 3,4, etc. I'm little confused which 1 to agree for.

0 Karma

somesoni2
Revered Legend

Do you've DMC configured on your search head? If you do, you can see all metrics about indexing in the indexing performance dashboard in there.
http://docs.splunk.com/Documentation/Splunk/7.0.3/DMC/IndexingDeployment

0 Karma

Rody333
New Member

I don't have privilege for DMC.. only I have is Search head with limited privilege. So, if you can help me with any search query can get me desired result.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!