Message per second (MPS)

[jplaberge]

How could we simply display how many messages (or events) Splunk receives/process per second (MPS : Message per second)?

[splunklab2013]

Does it allow to change the throughput counts per second? If YES, then in what parameter i can change the values to change the count of messages received/processed per second by Splunk?

[MuS]

Hi splunklab2013, you can limit forwards from sending too much data in limits.conf with this stanza:

[thruput]

maxKBps =
* If specified and not zero, this limits the speed through the thruput processor to the specified
rate in kilobytes per second.
* To control the CPU load while indexing, use this to throttle the number of events this indexer
processes to the rate (in KBps) you specify.

This must be set on the forwarder and not on the indexer!

Hope this helps, cheers MuS

[Lowell · Accepted solution]

You could try something like this:

index=_internal source=*metrics.log group="per_host_thruput" | timechart sum(eps)

These metrics are recorded every 30 seconds.