Getting Data In

Volume of SYSLOG traffic coming into splunk?

leonardw
Explorer

Does anyone know how to determine the volume of SYSLOG traffic coming into Splunk over a 30, 60, and 90 day period?

Tags (2)

BunnyHop
Contributor

This might also help.

http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage

You can tweak the xml to your needs.

0 Karma

Simeon
Splunk Employee
Splunk Employee

If syslog is one of the top ten sourcetypes or sources, then you can use the metrics log search below:

index=_internal source=*metrics.log* per_sourcetype_thruput series=syslog | eval gb=kb/1024/1024 | stats sum(gb) as Total

If you want to see a charted breakdown, you can substitute the timechart command for stats:

... | timechart span=1d sum(gb) as Total | addtotals

For the above searches, use the TimeRange picker to select the 30, 60, or 90 day duration. If syslog is not in the top ten sourcetypes, you'll have to do a somewhat expensive query that measures the raw size of the events. So something like:

sourcetype=syslog | eval size=len(_raw) | stats sum(size)

Lamar
Splunk Employee
Splunk Employee

Something like this will give you what you need.

index=_internal (source=*/metrics.log* OR source=*\\metrics.log*) group=per_sourcetype_thruput series=syslog | timechart sum(kb) by series

Then, just change your timeframe to 30, 60 or 90 days appropriately.

Lamar
Splunk Employee
Splunk Employee

Sadly, I believe the default setting for _internal is 28 days or 2419200 seconds. You can raise that setting 'frozenTimePeriodInSecs' to whatever fits for you so that you can get a greater field of view.

If there is no coldToFrozenScript set, it simply erases the data.

leonardw
Explorer

BTW - Thank you for your help with this. It's greatly appreciated.

0 Karma

leonardw
Explorer

The above query works; however anything after 30 days there is no data showing up. This system has been in production for several months. Could it be with logs being rotated? If so, how to proceed?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...