I would like to find out how many events per second my indexer is receiving and indexing.
What search could help me find this out?
Run the following search over the time range real-time(all time) and you will be able to see what your incoming event rate looks like :
index=savageclowns | eval searchtime=now() | eval secondselapsed=(time() - searchtime) | eval secs=if(secondselapsed<0,"1",secondselapsed) | stats count as ecount, last(secs) AS seconds| stats last(ecount) AS "event count", last(seconds) AS "search seconds elapsed", last(eval(ecount/seconds)) AS eps
This example targets a specific index, but feel free to change the first search terms to better suit your needs.
View solution in original post
savage_clowns killed me 😄 nice