Getting Data In

Splunk 7x Metrics - use cases and success stories

inventsekar
Ultra Champion

Hi All, May we know, how you guys are using the 7x feature metrics, some of your use cases, success stories please, how good this one is when compared to summary index / tstats, etc.. (didnt see many posts on this topic, thus creating one, for our learning and happy splunking )

Overview of metrics
Metrics is a feature for system administrators and IT tools engineers that focuses on collecting, investigating, monitoring, and sharing metrics from your technology infrastructure, security systems, and business applications in real time.

Metrics in the Splunk platform uses a custom index type that is optimized for metric storage and retrieval. To work with metrics, the mstats command is included for you to apply numeric aggregations (such as average, sum, percentile, and so forth) to isolate and correlate problems from different data sources.

You also see that you have to use a different set of commands to work with Metrics ( mstats and mcatalog) See here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Search

https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Overview

Old post for ref: https://answers.splunk.com/answers/588891/summary-indexes-metrics-in-splunk-700.html

0 Karma

inventsekar
Ultra Champion

any views, suggestions pls

0 Karma

gjanders
SplunkTrust
SplunkTrust

While it's not my app, I've used the Metricator application (nmon) for Splunk, I found the license usage to be slightly higher, the disk usage is slightly better than the previous data model acceleration attempt in 7.0.x

However from what I've read I should see further improvements in 7.1.x and 7.2.x in terms of the metric index size and speed.

In terms of advantages, there is no / minimal data model acceleration requirements, searches are faster and I can now look over a lot more data very quickly!
I previously used the Nmon application (log-based)

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...