How to find the total and average indexing rates for all indexers?

[kteng2024]

hi

Can I please know how to find the total indexing rate of all indexers and average indexing rate? Is there any query for it?

[hunters_splunk]

Hi keteng2024,

You can use the monitoring console to monitor the indexing rate.

1. In Splunk Web, select Settings > Monitoring Console.
2. From the Monitoring Control menu, select Indexing > Performance > Indexing Performance (Instance or Deployment).
3. Select options and view the indexing rate of all indexers or all indexes.
4. You can click the Open Search icon next to the indexing rate to view the query behind the statistics.

Here is a query example:

| rest splunk_server=hunter-mac-indexer /services/server/introspection/indexer
            | eval status = if((reason == ".") OR (reason == "") OR isnull(reason), status, status.": ".reason)
            | fields splunk_server, average_KBps, status
            | eval average_KBps = round(average_KBps, 0)
            | join [
              | rest splunk_server=<my_indexer_server> /services/properties/server/general/parallelIngestionPipelines]
            | fields splunk_server, value, average_KBps, status
            | rename splunk_server as Instance, value as "Pipeline Set Count", average_KBps as "Indexing Rate (KB/s)", status as Status, reason as Reason

Another example query to display indexing thruput:

index=_internal component=Metrics per_index_thruput
| eval mb=(kb/1024) | timechart span=1h sum(mb) by
series | addtotals

Hope it helps. Thanks!
Hunter

[hunters_splunk]

A small correction - In my first example query, hunter-mac-indexer should be , the hostname of the server you are running your indexer.
Thanks!

[dlamb_splunk]

Depending on what version you are running there may be a few places to look. That said the easiest and best place is probably the Monitoring Console, see link below for docs. If you want to run searches you can, see below for one example. There are a lot of answers already existing for ways to do that. There are quite a few different ways to get to the same data.

DMC - https://docs.splunk.com/Documentation/Splunk/6.5.1/DMC/DMCoverview

Search - https://answers.splunk.com/answers/154773/how-to-create-a-report-that-shows-max-indexed-volume-per-d...