Estimate Volume of Average Events Per Hour (in MB) for an Index/Sourcetype

[SplunkDash]

Hello,

I can estimate the # of average events SPLUNK has for an index/sourcetype using following line of query /codes. How I would estimate the average Volume of data (in MB) SPLUNK receives per our for that index.  Thank you so much, appreciate your support.

Query to Estimate # of Ave Events per hour:

index=win_test sourcetype=* |bucket _time span=1h|stats count by _time|stats avg(count) as "Ave Events per Hour"

[johnhuang]

index=_internal source=*metrics.log group=per_sourcetype_thruput earliest=-7d@d
| bucket _time span=1h
| stats sum(kb) AS size_kb BY _time series
| eval size_mb=size_kb/1024
| eval event_hour=strftime(_time, "%H:%M")
| rename series AS data_source
| chart limit=24 avg(size_mb) AS size_mb by data_source event_hour
| fillnull value="0.00"
| addtotals fieldname="hourly_avg"
| eval hourly_avg=ROUND(hourly_avg/24, 2)
| foreach *:* hourly_avg [| eval <<FIELD>>=ROUND('<<FIELD>>', 2)]

[richgalloway · Accepted solution]

I believe the Monitoring Console has a dashboard panel that will provide that information.

If you want to do it yourself, try this variation of your query.

index=win_test sourcetype=* 
| bucket _time span=1h
| stats sum(eval(len(_raw))) as bytes by _time
| stats avg(bytes) as avgBytes
| eval avgMB=avgBytes/1024/1024
| rename avgMB as "Ave MB per Hour"

[tro]

---

@richgalloway wrote:

I believe the Monitoring Console has a dashboard panel that will provide that information.

If you want to do it yourself, try this variation of your query.

index=win_test sourcetype=* 
| bucket _time span=1h
| stats sum(eval(len(_raw)) as bytes by _time
| stats avg(bytes) as avgBytes
| eval avgMB=avgBytes/1024/1024
| rename avgMB as "Ave MB per Hour"

---

You query contains mismatched parenthesis on `sum` line.

[richgalloway]

Fixed.  Thanks for letting me know.