Performance data collecting and analytics

[kiranmudunuru]

I have a tool which has its performance data in its database. i am getting the output of it in a flat file and then intend to read it to provide some analytics based on the performance data that is captured.

However, need some assistance/ guidance on this. any tips on this will be most welcome.

Regards,
KM

[jordanperks · Accepted solution]

Install the Splunk Universal forwarder and point it at the file. If you want to do some predictions and anomaly detection check out the predict command (I think it was introduced in Splunk 6.0). http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Predict

Here is an example of how I am using the predict command in order to determine when Symantec detects more viruses/hour than normal:
index=symantec (virus OR "security risk" OR "web attack") NOT "Tracking Cookies" earliest=-21d@d latest=now | rex "(?i) name: (?P[^,]+)" | bucket span=1h _time | timechart span=1h count(virus_host) as count | predict count | rename upper95(prediction(count)) as upper95 | fieldformat upper95=round(upper95,0) | sort -_time | eval Percent=round(upper95/count*100,0) | eval PercentAbove95thPecentile=round(100-Percent,0) | fields - Percent,lower95(prediction(count)),prediction(count) | fillnull value=0 count PercentAbove95thPecentile | head 10 | where PercentAbove95thPecentile>=1