Getting Data In

Splunk 7x Metrics - use cases and success stories

inventsekar
Super Champion

Hi All, May we know, how you guys are using the 7x feature metrics, some of your use cases, success stories please, how good this one is when compared to summary index / tstats, etc.. (didnt see many posts on this topic, thus creating one, for our learning and happy splunking )

Overview of metrics
Metrics is a feature for system administrators and IT tools engineers that focuses on collecting, investigating, monitoring, and sharing metrics from your technology infrastructure, security systems, and business applications in real time.

Metrics in the Splunk platform uses a custom index type that is optimized for metric storage and retrieval. To work with metrics, the mstats command is included for you to apply numeric aggregations (such as average, sum, percentile, and so forth) to isolate and correlate problems from different data sources.

You also see that you have to use a different set of commands to work with Metrics ( mstats and mcatalog) See here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Search

https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Overview

Old post for ref: https://answers.splunk.com/answers/588891/summary-indexes-metrics-in-splunk-700.html

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

inventsekar
Super Champion

any views, suggestions pls

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

gjanders
SplunkTrust
SplunkTrust

While it's not my app, I've used the Metricator application (nmon) for Splunk, I found the license usage to be slightly higher, the disk usage is slightly better than the previous data model acceleration attempt in 7.0.x

However from what I've read I should see further improvements in 7.1.x and 7.2.x in terms of the metric index size and speed.

In terms of advantages, there is no / minimal data model acceleration requirements, searches are faster and I can now look over a lot more data very quickly!
I previously used the Nmon application (log-based)

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...