Splunk Search

How to compare splunk ingestion volume?

kranthimutyala
Path Finder

Hi Team,

I'm looking for a query to compare Splunk ingestion volume between the current date and a week ago i.e compare today's ingestion volume with exact same day a week ago and get the % difference. Please let me know if there are any queries available preferably with REST Services.Thanks

 

 

Labels (4)
Tags (2)
0 Karma

kranthimutyala
Path Finder

I tried this but interestingly 7days ago im getting 10x more values than yesterday data, can you please re-look into this @schose 

0 Karma

schose
Builder

hi,

you can try to verify using license usage:

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" sourcetype=splunkd earliest=-7d@d latest=-6d@d 
| stats sum(b) as lic_7d 
| append 
    [ search index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" sourcetype=splunkd earliest=-1d@d latest=-0d@d 
    | stats sum(b) as lic_yesterday
        ]
| stats values(*) as *
| eval pct=round((lic_yesterday/lic_7d)*100)

 

license usage is also a good indicator for ingest - could be just misleading if you are doing a lot of metric conversion.. 

0 Karma

schose
Builder

Hi,

i guess i would use splunkd metrics for that :

index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" "group=thruput" "name=index_thruput" instantaneous_kbps earliest=-7d@d latest=-6d@d | stats sum(instantaneous_kbps) as ingest_pipe_instantaneous_kbps by ingest_pipe host | stats sum(ingest_pipe_instantaneous_kbps) as total_7d_ago by host
| append [
search index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" "group=thruput" "name=index_thruput" instantaneous_kbps earliest=-1d@d latest=-0d@d | stats sum(instantaneous_kbps) as ingest_pipe_instantaneous_kbps by ingest_pipe host | stats sum(ingest_pipe_instantaneous_kbps) as total_yesterday by host
]
| stats values(*) as * by host
| eval pct=round((total_yesterday/total_7d_ago)*100,1)

 

in this example we calculate the sum of instantaneous_kbs per indexer per ingest_pipeline 7 days ago and compare it to yesterday. you might want to adjust times.. 

 

best regards,

Andreas

0 Karma

schose
Builder

the cheaper way is to use _metrics index

| mstats sum("spl.mlog.thruput.thruput.instantaneous_kbps") as total_7d_ago WHERE "index"="_metrics" earliest=-7d@d latest=-6d@d host=INDEXER BY host
| append
[
| mstats sum("spl.mlog.thruput.thruput.instantaneous_kbps") as total_yesterday WHERE "index"="_metrics" earliest=-1d@d latest=-0d@d host=INDEXER BY host
]
| stats values(*) as * by host
| eval pct=round((total_yesterday/total_7d_ago)*100,1)

you have to place you indexers with or in where part.

regards,

Andreas

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...