Archive

Measure throughput (eps, kbps) per Input

Communicator

We would like to measure the performance and throughput. I would like to have line-graphs that shows:

  1. Throughput per input in kilobyte/sec (kbps)

  2. Throughput per input in events/sec (eps)

Thanks,

Jens

Tags (1)

Motivator

If you're running the latest version, some of that info is on the Index Activity dashboard, and you can use that search as a start.

By input, are you referring to source, sourcetype, or host?

kbps by sourcetype: index="_internal" (source=/metrics.log OR source=\metrics.log) group="per_sourcetype_thruput" | timechart avg(kbps) by series

eps by sourcetype: index="_internal" (source=/metrics.log OR source=\metrics.log) group="per_sourcetype_thruput" | timechart avg(eps) by series

If you wanted host or source, use group="per_source_thruput" or group="per_host_thruput" instead.

Communicator

Hello Jeremiah,

seems like i have to enable something, because your searches return nothing.

I am using Splunk 4.1.2

Cheers,

Jens

0 Karma

Splunk Employee
Splunk Employee

and if you want more data you can use source=metrics.log
This will include metrics.log.1-5

0 Karma

Super Champion

You can just do source=*metrics.log

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!