Splunk Search

How do you quantify how much data is coming in for a specific key-value pair?


I am trying to find out just how much data is coming in for a specific key value pair?
So we have only two sourcetypes and I am trying to determine a recent spike in traffic, but I am having a difficult time quantifying where the spike came from using normal field values.

0 Karma


Perhaps something like this

index=foo earliest=-2mon@mon | eval mon=strftime(_time, "%b") | chart count over key by mon
0 Karma


Maybe this will help

index=foo key=value | eval size=len(_raw) | stats dc(_time) sum(size)
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.