Splunk 7x Metrics - use cases and success stories

[inventsekar]

Hi All, May we know, how you guys are using the 7x feature metrics, some of your use cases, success stories please, how good this one is when compared to summary index / tstats, etc.. (didnt see many posts on this topic, thus creating one, for our learning and happy splunking )

Overview of metrics
Metrics is a feature for system administrators and IT tools engineers that focuses on collecting, investigating, monitoring, and sharing metrics from your technology infrastructure, security systems, and business applications in real time.

Metrics in the Splunk platform uses a custom index type that is optimized for metric storage and retrieval. To work with metrics, the mstats command is included for you to apply numeric aggregations (such as average, sum, percentile, and so forth) to isolate and correlate problems from different data sources.

You also see that you have to use a different set of commands to work with Metrics ( mstats and mcatalog) See here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Search

https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Overview

Old post for ref: https://answers.splunk.com/answers/588891/summary-indexes-metrics-in-splunk-700.html

[inventsekar]

any views, suggestions pls

[gjanders]

While it's not my app, I've used the Metricator application (nmon) for Splunk, I found the license usage to be slightly higher, the disk usage is slightly better than the previous data model acceleration attempt in 7.0.x

However from what I've read I should see further improvements in 7.1.x and 7.2.x in terms of the metric index size and speed.

In terms of advantages, there is no / minimal data model acceleration requirements, searches are faster and I can now look over a lot more data very quickly!
I previously used the Nmon application (log-based)