graphing input rates

[danp]

Hello,

I'm interested in creating a chart  or dashboard to graph the rates of change for either my inputs, sources, hosts, indexes and source types.

Just not sure where to start query-wise and guess once I have a base query I can modify it to create the others.

Thanks for any help,

Dan

[tscroggins]

The management console searches bundled with Splunk Enterprise provide examples of working with metrics.log data. From Settings > Management Console, navigate to Indexing > License Usage > Historic License Usage.

If your category of interest is squelched, you can summarize over indexes directly using e.g. tstats:

| tstats count where index=main earliest=-7d@d latest=@d by _time span=1d host
| streamstats current=f last(count) as previous_count
| eval percent_change=100*(count-previous_count)/count
| where NOT isnull(percent_change)

You could alternatively look at third-party solutions, e.g. Meta Woot! by @DiscoveredIntel.