Determining Log Rates/Sizes

[SLS-CCU]

Our networking team is looking to determine Log Rates for different systems reporting in Splunk.

How can we determine how often a log is created for an individual system and determine the average size of these logs?

Thank you!

[PickleRick]

It depends on what mechanism you use to collect the data and wheyher you can reliably distinguish between different sources. If - for example you have several hosts reporting to a common syslog input which sets source as udp:514 and they are misconfigured and don't report their hostname correctly (or simply log in some strange format that doesn't produce reasonable host field), there is no way to calculate stats per single source, you can just have aggregated values. But that's also a design problem on a completely different level because having an event you can't tell where it came from.

So the answer to your question is highly dependent on your particular architecture and configuration.

[gcusello]

Hi @SLS-CCU,

if you're speaking of logs from other servers with Splunk Universal Forwarder, using the Splunk Monitoring Console app you can see the the rate of logs flows from each server.

Instead if you want to measure logs from appliances using syslog, you have to see in the License consuption dashboard and you can have the values of the logs daily ingested for each appliance, so you can meke an average.

Ciao.

Giuseppe