Monitoring Splunk

best approach to speed access to Linux performance data such as iostat vmstat and so on

ebaileytu
Communicator

We have a vast amount of performance data and I want to make better use of the data by speeding up access to make it easier to query and compare data over the long term. What is the preferred method of data acceleration? I have been moving forward with report acceleration but I want to get feedback on the best practice.

Report Acceleration or Accelerated Data models?

For iostat, we have approx. 1 million results every 5 minutes.

Should I setup an accelerated report for each sourcetype with min max and avg calculated per host or something else? I do not want to get too far into the project and then figure out I am doing it all wrong.

Thanks in advance

0 Karma

gjanders
SplunkTrust
SplunkTrust

Have you looked at the nmon application for Splunk ? NMON Performance Monitor for Unix and Linux Systems ?
https://splunkbase.splunk.com/app/1753/

It does most of what you are trying to do, and it would be easier than trying to build data models and then accelerating them for the information you require (the nmon app has a number of accelerated data models).

ddrillic
Ultra Champion

Please keep in mind that an app for such a purpose exists at - Splunk App for Unix and Linux

Forwarding Linux command outputs to dashboard
says -

alt text

A related documentation at Logging best practices

ebaileytu
Communicator

Already using the Unix Linux TA with a number of extension hence the large data set we already have already have in Splunk. The App for Unix Linux gives some good examples but does not present that metrics we want and it is very slow with large data sets.

0 Karma

sundareshr
Legend

Both are good approaches to improve performance. Report Acceleration is good if all you need is the final report. You cannot benefit from the acceleration if you decide to open the search and make changes. With the data model, on the other hand, you can keep building on it. The third option would be to use Summary Index, I would recommend Accelerated Data Model

I any case, you will need to plan ahead to before your pick your best approach.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...