Getting Data In

How to send a notification when the my iindexer process through a certain amount of forwarded data

seanlon11
Path Finder

I want a search that will tell me the total throughput of my indexing server, and then setup a notification if that total amount is more than 1 Gigabyte of data.

Any suggestions?

Thanks, Sean

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

To calculate the indexing volume for the day use:

index=_internal group=per_index_thruput earliest=@d | stats sum(kb) as KB_indexed

Then schedule this search with the custom criteria: "where KB_indexed > 1000000 | stats count | where count > 0"

This will alert you whenever the volume is more than 1GB for the day.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

To calculate the indexing volume for the day use:

index=_internal group=per_index_thruput earliest=@d | stats sum(kb) as KB_indexed

Then schedule this search with the custom criteria: "where KB_indexed > 1000000 | stats count | where count > 0"

This will alert you whenever the volume is more than 1GB for the day.

seanlon11
Path Finder

I don't understand. Why is my

_internal = 3263.3 M
main = 2022.4599 M

Aren't licenses based off of the "main" indexer? If so, shouldn't I be trying to total up the main indexer instead of the "_internal"?

(fwiw - trying to run the aforementioned query with the main indexer does not work, and the main indexer is extremely slow when trying to look through everything)

Please advise.

Thanks!
Sean

0 Karma

seanlon11
Path Finder

where KB_indexed > 1000000 | stats count | where count > 0

The "where" clause was missing. My bad.

0 Karma

seanlon11
Path Finder

KB_indexed > 1000000 | stats count | search count > 0

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Sean, what is the exact custom criteria that you're trying?

0 Karma

seanlon11
Path Finder

Thanks for the help Lowell, but I am running into a similar issue:

Encountered the following error while trying to save: In handler 'savedsearch': Cannot parse alert condition. Search operation 'kb' is unknown. You might not have permission to run this operation.

Why does it not recognize the "kb" from the original search?

Thanks,
Sean

0 Karma

Lowell
Super Champion

Try where KB_indexed > 1000000 | stats count | search count > 0

0 Karma

seanlon11
Path Finder

Thanks for the help. The query appears to work as expected, but when I try to add the custom criteria you provided above, I receive the following Error:

Encountered the following error while trying to save: In handler 'savedsearch': Cannot parse alert condition. Search operation 'count' is unknown. You might not have permission to run this operation.

What I have as my Customer Criteria:

where KB_indexed > 1000000 | stats count | count > 0

Any ideas what steps are needed to correct the error above?

Thanks,
Sean

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...