Splunk Search
Highlighted

How to find the total and average indexing rates for all indexers?

Path Finder

hi

Can I please know how to find the total indexing rate of all indexers and average indexing rate? Is there any query for it?

0 Karma
Highlighted

Re: How to find the total and average indexing rates for all indexers?

Splunk Employee
Splunk Employee

Depending on what version you are running there may be a few places to look. That said the easiest and best place is probably the Monitoring Console, see link below for docs. If you want to run searches you can, see below for one example. There are a lot of answers already existing for ways to do that. There are quite a few different ways to get to the same data.

DMC - https://docs.splunk.com/Documentation/Splunk/6.5.1/DMC/DMCoverview

Search - https://answers.splunk.com/answers/154773/how-to-create-a-report-that-shows-max-indexed-volume-per-d...

0 Karma
Highlighted

Re: How to find the total and average indexing rates for all indexers?

Splunk Employee
Splunk Employee

Hi keteng2024,

You can use the monitoring console to monitor the indexing rate.

  1. In Splunk Web, select Settings > Monitoring Console.
  2. From the Monitoring Control menu, select Indexing > Performance > Indexing Performance (Instance or Deployment).
  3. Select options and view the indexing rate of all indexers or all indexes.
  4. You can click the Open Search icon next to the indexing rate to view the query behind the statistics.

Here is a query example:

| rest splunk_server=hunter-mac-indexer /services/server/introspection/indexer
            | eval status = if((reason == ".") OR (reason == "") OR isnull(reason), status, status.": ".reason)
            | fields splunk_server, average_KBps, status
            | eval average_KBps = round(average_KBps, 0)
            | join [
              | rest splunk_server=<my_indexer_server> /services/properties/server/general/parallelIngestionPipelines]
            | fields splunk_server, value, average_KBps, status
            | rename splunk_server as Instance, value as "Pipeline Set Count", average_KBps as "Indexing Rate (KB/s)", status as Status, reason as Reason

Another example query to display indexing thruput:

index=_internal component=Metrics per_index_thruput
| eval mb=(kb/1024) | timechart span=1h sum(mb) by
series | addtotals

Hope it helps. Thanks!
Hunter

0 Karma
Highlighted

Re: How to find the total and average indexing rates for all indexers?

Splunk Employee
Splunk Employee

A small correction - In my first example query, hunter-mac-indexer should be , the hostname of the server you are running your indexer.
Thanks!

0 Karma