Splunk Search

How to find the total and average indexing rates for all indexers?

kteng2024
Path Finder

hi

Can I please know how to find the total indexing rate of all indexers and average indexing rate? Is there any query for it?

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi keteng2024,

You can use the monitoring console to monitor the indexing rate.

  1. In Splunk Web, select Settings > Monitoring Console.
  2. From the Monitoring Control menu, select Indexing > Performance > Indexing Performance (Instance or Deployment).
  3. Select options and view the indexing rate of all indexers or all indexes.
  4. You can click the Open Search icon next to the indexing rate to view the query behind the statistics.

Here is a query example:

| rest splunk_server=hunter-mac-indexer /services/server/introspection/indexer
            | eval status = if((reason == ".") OR (reason == "") OR isnull(reason), status, status.": ".reason)
            | fields splunk_server, average_KBps, status
            | eval average_KBps = round(average_KBps, 0)
            | join [
              | rest splunk_server=<my_indexer_server> /services/properties/server/general/parallelIngestionPipelines]
            | fields splunk_server, value, average_KBps, status
            | rename splunk_server as Instance, value as "Pipeline Set Count", average_KBps as "Indexing Rate (KB/s)", status as Status, reason as Reason

Another example query to display indexing thruput:

index=_internal component=Metrics per_index_thruput
| eval mb=(kb/1024) | timechart span=1h sum(mb) by
series | addtotals

Hope it helps. Thanks!
Hunter

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

A small correction - In my first example query, hunter-mac-indexer should be , the hostname of the server you are running your indexer.
Thanks!

0 Karma

dlamb_splunk
Splunk Employee
Splunk Employee

Depending on what version you are running there may be a few places to look. That said the easiest and best place is probably the Monitoring Console, see link below for docs. If you want to run searches you can, see below for one example. There are a lot of answers already existing for ways to do that. There are quite a few different ways to get to the same data.

DMC - https://docs.splunk.com/Documentation/Splunk/6.5.1/DMC/DMCoverview

Search - https://answers.splunk.com/answers/154773/how-to-create-a-report-that-shows-max-indexed-volume-per-d...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...