Hello,
I can estimate the # of average events SPLUNK has for an index/sourcetype using following line of query /codes. How I would estimate the average Volume of data (in MB) SPLUNK receives per our for that index. Thank you so much, appreciate your support.
Query to Estimate # of Ave Events per hour:
index=win_test sourcetype=* |bucket _time span=1h|stats count by _time|stats avg(count) as "Ave Events per Hour"
I believe the Monitoring Console has a dashboard panel that will provide that information.
If you want to do it yourself, try this variation of your query.
index=win_test sourcetype=*
| bucket _time span=1h
| stats sum(eval(len(_raw))) as bytes by _time
| stats avg(bytes) as avgBytes
| eval avgMB=avgBytes/1024/1024
| rename avgMB as "Ave MB per Hour"
index=_internal source=*metrics.log group=per_sourcetype_thruput earliest=-7d@d
| bucket _time span=1h
| stats sum(kb) AS size_kb BY _time series
| eval size_mb=size_kb/1024
| eval event_hour=strftime(_time, "%H:%M")
| rename series AS data_source
| chart limit=24 avg(size_mb) AS size_mb by data_source event_hour
| fillnull value="0.00"
| addtotals fieldname="hourly_avg"
| eval hourly_avg=ROUND(hourly_avg/24, 2)
| foreach *:* hourly_avg [| eval <<FIELD>>=ROUND('<<FIELD>>', 2)]
I believe the Monitoring Console has a dashboard panel that will provide that information.
If you want to do it yourself, try this variation of your query.
index=win_test sourcetype=*
| bucket _time span=1h
| stats sum(eval(len(_raw))) as bytes by _time
| stats avg(bytes) as avgBytes
| eval avgMB=avgBytes/1024/1024
| rename avgMB as "Ave MB per Hour"
@richgalloway wrote:I believe the Monitoring Console has a dashboard panel that will provide that information.
If you want to do it yourself, try this variation of your query.
index=win_test sourcetype=*
| bucket _time span=1h
| stats sum(eval(len(_raw)) as bytes by _time
| stats avg(bytes) as avgBytes
| eval avgMB=avgBytes/1024/1024
| rename avgMB as "Ave MB per Hour"
You query contains mismatched parenthesis on `sum` line.
Fixed. Thanks for letting me know.