Chart indexed events per second over time

[dslevy]

How can I use this to make a chart and graph over a 7 day period (for example) without running it in realtime? I want to be able to see the eps for a sourcetype so I can make an alert when a threshold is reached. I tried using:

index="_internal" (source=*metrics.log) group="per_sourcetype_thruput" series="cisco_asa" | timechart span=30m max(eps)

But this doesn't match up with another system I am using especially when a spike occurs.

[hexx]

You cannot use metrics.log's "per_sourcetype_thruput" for this because it only samples the top 10 busiest source types for every capture period of 30s.

To accurately measure the rate of indexing of a given source type over time, you'd have to go to the events themselves and cursor your search using _indextime instead of _time, like so:

index=cisco sourcetype="cisco_asa"
| eval _time = _indextime
| bin _time span=30m
| stats count by _time
| timechart span=30m per_second(count) AS EPS