Archive

Performance data collecting and analytics

New Member

I have a tool which has its performance data in its database. i am getting the output of it in a flat file and then intend to read it to provide some analytics based on the performance data that is captured.

However, need some assistance/ guidance on this. any tips on this will be most welcome.

Regards,
KM

Tags (1)
0 Karma
1 Solution

Path Finder

Install the Splunk Universal forwarder and point it at the file. If you want to do some predictions and anomaly detection check out the predict command (I think it was introduced in Splunk 6.0). http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Predict

Here is an example of how I am using the predict command in order to determine when Symantec detects more viruses/hour than normal:
index=symantec (virus OR "security risk" OR "web attack") NOT "Tracking Cookies" earliest=-21d@d latest=now | rex "(?i) name: (?P[^,]+)" | bucket span=1h _time | timechart span=1h count(virus_host) as count | predict count | rename upper95(prediction(count)) as upper95 | fieldformat upper95=round(upper95,0) | sort -_time | eval Percent=round(upper95/count*100,0) | eval PercentAbove95thPecentile=round(100-Percent,0) | fields - Percent,lower95(prediction(count)),prediction(count) | fillnull value=0 count PercentAbove95thPecentile | head 10 | where PercentAbove95thPecentile>=1

View solution in original post

0 Karma

Path Finder

Install the Splunk Universal forwarder and point it at the file. If you want to do some predictions and anomaly detection check out the predict command (I think it was introduced in Splunk 6.0). http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Predict

Here is an example of how I am using the predict command in order to determine when Symantec detects more viruses/hour than normal:
index=symantec (virus OR "security risk" OR "web attack") NOT "Tracking Cookies" earliest=-21d@d latest=now | rex "(?i) name: (?P[^,]+)" | bucket span=1h _time | timechart span=1h count(virus_host) as count | predict count | rename upper95(prediction(count)) as upper95 | fieldformat upper95=round(upper95,0) | sort -_time | eval Percent=round(upper95/count*100,0) | eval PercentAbove95thPecentile=round(100-Percent,0) | fields - Percent,lower95(prediction(count)),prediction(count) | fillnull value=0 count PercentAbove95thPecentile | head 10 | where PercentAbove95thPecentile>=1

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!