The Splunk Product Best Practices team helped produce this response. Read more about use case examples Splunk® Platform Use Cases on Splunk Docs.
This use case enables analysts and application developers to monitor trends in the number of events being logged by an application, which can indicate the state of your application and/or changes in behavior of your code or environment.
This use case is from the Splunk Essentials for Infrastructure Troubleshooting and Monitoring app. For more examples, see the Splunk Essentials for Infrastructure Troubleshooting and Monitoring on Splunkbase.
Load data
How to implement: Ingest application, operating system, microservices, virtualization, and/or network logs into Splunk Enterprise. Summarize the event count over time using the timechart command. Leverage any fields that provide useful split by fields present in your logs, such as host, response code, or log level.
Data check: This use case depends on application, operating system, microservices, virtualization, or network logs. For best results, add the desired sources, source types, hosts, or indexes to the first line of the base search.
Get insights
Baseline and analyze log volume trends in your applications to monitor their relative health using the timechart command and split by fields present in your logs, such as host, response code, or log level. Analysts and application developers can inve
Use the following search:
index=*
| timechart limit=0 partial=false span=1m count BY host
Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Help
If no results appear, deploy the Add-ons to the search heads to access the knowledge objects necessary for simple searching. See About installing Splunk add-ons on Splunk Docs for assistance.
For more support, post a question to the Splunk Answers community.
The Splunk Product Best Practices team helped produce this response. Read more about use case examples Splunk® Platform Use Cases on Splunk Docs.
This use case enables analysts and application developers to monitor trends in the number of events being logged by an application, which can indicate the state of your application and/or changes in behavior of your code or environment.
This use case is from the Splunk Essentials for Infrastructure Troubleshooting and Monitoring app. For more examples, see the Splunk Essentials for Infrastructure Troubleshooting and Monitoring on Splunkbase.
Load data
How to implement: Ingest application, operating system, microservices, virtualization, and/or network logs into Splunk Enterprise. Summarize the event count over time using the timechart command. Leverage any fields that provide useful split by fields present in your logs, such as host, response code, or log level.
Data check: This use case depends on application, operating system, microservices, virtualization, or network logs. For best results, add the desired sources, source types, hosts, or indexes to the first line of the base search.
Get insights
Baseline and analyze log volume trends in your applications to monitor their relative health using the timechart command and split by fields present in your logs, such as host, response code, or log level. Analysts and application developers can inve
Use the following search:
index=*
| timechart limit=0 partial=false span=1m count BY host
Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Help
If no results appear, deploy the Add-ons to the search heads to access the knowledge objects necessary for simple searching. See About installing Splunk add-ons on Splunk Docs for assistance.
For more support, post a question to the Splunk Answers community.
