Splunk Dev

Hi, please help me asap if possible. I'm using splunk could and having access to search head. Is there any search query to find out indexing and EPS rate.

Rody333
New Member

I'm using splunk could and having access to search head. Is there any search query to find out indexing and EPS rate.

Tags (1)
0 Karma

elliotproebstel
Champion

Here are some queries supplied by @martin_mueller in an older post.

 index=_internal component=metrics TERM(group=thruput) | timechart per_second(ev) by splunk_server
 index=_internal component=metrics TERM(group=thruput) | timechart avg(instantaneous_eps) by splunk_server

He suggests that the two may produce very different metrics if your server isn't on all day.

elliotproebstel
Champion

Have you had a chance to try these queries? Did they work for you?

0 Karma

Rody333
New Member

Yes, I got results. Just to confirm: 1st query is to get indexing rate in kbps and 2nd query is to get "event per second'. Please correct me.

0 Karma

elliotproebstel
Champion

According to @martin_mueller, both of these should be outputting events per second.

0 Karma

Rody333
New Member

okay, but both giving different results like 1st query giving 200,210 etc and 2nd query giving 3,4, etc. I'm little confused which 1 to agree for.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Do you've DMC configured on your search head? If you do, you can see all metrics about indexing in the indexing performance dashboard in there.
http://docs.splunk.com/Documentation/Splunk/7.0.3/DMC/IndexingDeployment

0 Karma

Rody333
New Member

I don't have privilege for DMC.. only I have is Search head with limited privilege. So, if you can help me with any search query can get me desired result.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...