Calculating Source type info indexing rate and EPS

[Splunk_rocks]

Hello Splunkers,

I would like to calculate below EPS values for 30 days time period for each source type on one combined search and i have individual searches but just want to see if i can get some thing here.

Average Event Size EPS (KBPS)
Max EPS (KBPS)
Average EPS (KB)
General EPS (KB)

[damiensurat]

If you're running the latest version, some of that info is on the Index Activity dashboard, and you can use that search as a start.

Change out the calc for measuring max, min, avg, etc
EG:
timechart avg(kbps) by series
timechart max(kbps) by series

kbps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(kbps) by series

eps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(eps) by series

If you wanted host or source, use group="per_source_thruput" or group="per_host_thruput" instead.

ah, one more suggestion... If you don't want to chart the results in a timeseries, you can swap out the timechart command with the stats command which may be a better fit for the solution you are looking for:

EG:
index="_internal" source=*metrics.log group="per_sourcetype_thruput" | stats avg(eps) by series

[Splunk_rocks]

Thanks but i dont have access to DMC so that is why im looking for individual searches .

[Splunk_rocks]

I just need calculate index=* sourcetype=* not from internal index

[damiensurat]

Use tstats and specify the variables:

• index=main
• earliest=-30d
• groupby (_time, sourcetype)
• span=1s

| tstats count as COUNT where index=main earliest=-30d by _time,sourcetype span=1s | timechart span=1h max(COUNT) as eps by sourcetype useother=f