Splunk Search

How to edit my search to track the amount of data being ingested to a specific index, measured in MB/per minute?

dsofoulis
Path Finder

I'm trying to write a search to track the amount of data being ingested to a specific index, measured in MB/per minute.
This is what I have so far:

index=my_index_name metrics name=index_thruput sourcetype=splunkd | timechart span=1m sum(eval(kb/1024)) as "MB/min"
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

That metric will give you the total indexing thruput, not the per-index thruput. You'll want something like this:

  index=_internal sourcetype=splunkd source=*metrics.log* group=per_index_thruput series=_internal
| timechart per_minute(kb) as kbpm | eval mbpm = kbpm/1024 | fields - kbpm

That gives you the MB/min thruput for the _internal index, swap the series value as you wish.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That metric will give you the total indexing thruput, not the per-index thruput. You'll want something like this:

  index=_internal sourcetype=splunkd source=*metrics.log* group=per_index_thruput series=_internal
| timechart per_minute(kb) as kbpm | eval mbpm = kbpm/1024 | fields - kbpm

That gives you the MB/min thruput for the _internal index, swap the series value as you wish.

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...