How to compare splunk ingestion volume?

[kranthimutyala]

Hi Team,

I'm looking for a query to compare Splunk ingestion volume between the current date and a week ago i.e compare today's ingestion volume with exact same day a week ago and get the % difference. Please let me know if there are any queries available preferably with REST Services.Thanks

[kranthimutyala]

I tried this but interestingly 7days ago im getting 10x more values than yesterday data, can you please re-look into this @schose 

[schose]

hi,

you can try to verify using license usage:

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" sourcetype=splunkd earliest=-7d@d latest=-6d@d 
| stats sum(b) as lic_7d 
| append 
    [ search index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" sourcetype=splunkd earliest=-1d@d latest=-0d@d 
    | stats sum(b) as lic_yesterday
        ]
| stats values(*) as *
| eval pct=round((lic_yesterday/lic_7d)*100)

license usage is also a good indicator for ingest - could be just misleading if you are doing a lot of metric conversion.. 

[schose]

Hi,

i guess i would use splunkd metrics for that :

index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" "group=thruput" "name=index_thruput" instantaneous_kbps earliest=-7d@d latest=-6d@d | stats sum(instantaneous_kbps) as ingest_pipe_instantaneous_kbps by ingest_pipe host | stats sum(ingest_pipe_instantaneous_kbps) as total_7d_ago by host
| append [
search index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" "group=thruput" "name=index_thruput" instantaneous_kbps earliest=-1d@d latest=-0d@d | stats sum(instantaneous_kbps) as ingest_pipe_instantaneous_kbps by ingest_pipe host | stats sum(ingest_pipe_instantaneous_kbps) as total_yesterday by host
]
| stats values(*) as * by host
| eval pct=round((total_yesterday/total_7d_ago)*100,1)

in this example we calculate the sum of instantaneous_kbs per indexer per ingest_pipeline 7 days ago and compare it to yesterday. you might want to adjust times.. 

best regards,

Andreas

[schose]

the cheaper way is to use _metrics index

| mstats sum("spl.mlog.thruput.thruput.instantaneous_kbps") as total_7d_ago WHERE "index"="_metrics" earliest=-7d@d latest=-6d@d host=INDEXER BY host
| append
[
| mstats sum("spl.mlog.thruput.thruput.instantaneous_kbps") as total_yesterday WHERE "index"="_metrics" earliest=-1d@d latest=-0d@d host=INDEXER BY host
]
| stats values(*) as * by host
| eval pct=round((total_yesterday/total_7d_ago)*100,1)

you have to place you indexers with or in where part.

regards,

Andreas