Dashboards & Visualizations

graphing input rates

danp
New Member

Hello,

I'm interested in creating a chart  or dashboard to graph the rates of change for either my inputs, sources, hosts, indexes and source types.

Just not sure where to start query-wise and guess once I have a base query I can modify it to create the others.

Thanks for any help,

Dan

 

Labels (1)
0 Karma

tscroggins
Influencer

The management console searches bundled with Splunk Enterprise provide examples of working with metrics.log data. From Settings > Management Console, navigate to Indexing > License Usage > Historic License Usage.

If your category of interest is squelched, you can summarize over indexes directly using e.g. tstats:

| tstats count where index=main earliest=-7d@d latest=@d by _time span=1d host
| streamstats current=f last(count) as previous_count
| eval percent_change=100*(count-previous_count)/count
| where NOT isnull(percent_change)

You could alternatively look at third-party solutions, e.g. Meta Woot! by @DiscoveredIntel.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...