Hello,
I'm interested in creating a chart or dashboard to graph the rates of change for either my inputs, sources, hosts, indexes and source types.
Just not sure where to start query-wise and guess once I have a base query I can modify it to create the others.
Thanks for any help,
Dan
The management console searches bundled with Splunk Enterprise provide examples of working with metrics.log data. From Settings > Management Console, navigate to Indexing > License Usage > Historic License Usage.
If your category of interest is squelched, you can summarize over indexes directly using e.g. tstats:
| tstats count where index=main earliest=-7d@d latest=@d by _time span=1d host
| streamstats current=f last(count) as previous_count
| eval percent_change=100*(count-previous_count)/count
| where NOT isnull(percent_change)
You could alternatively look at third-party solutions, e.g. Meta Woot! by @DiscoveredIntel.