Is it possible to increment values time after time ?

[RomainH]

Hi there,

Because of some product limitations on a SMTP server, I need to desactivate snmp polling but I have to keep an eye on the mail queue growth.

The server is sending real time logs to splunk via syslog and I already identified fields to find out if a mail has just been queued, or if it has been delivered from queue.
My problem is what I get is the current value, and not the sum of the queue size.

Is there a way to add the new value with previous result (by minute) and graph it in a timechart to get a representative view of the queue size ?

secondarily, I cant get to substract the out value from the IN, here's my code:

| eval queuein=case(stat == "Deferred:", "FILL IN") 
| eval queueout=case(stat == "Sent", "FILL OUT")
| eval queue=queuein-queueout

If anyone could help me with that, I'd really appreciate.
Regards,
Romain.

[chris · Accepted solution]

If you want to display the stats per minute the following search might work:

<basesearch> | eval counter=if(stat="Deferred:",1,-1) | timechart span=1m sum(counter)

If you want to see how the queue size develops over time:

<basesearch> | eval counter=if(stat="Deferred",1,-1) | reverse |streamstats sum(counter) as running_count | timechart span=1m avg(running_count) min(running_count) max(running_count) 

You will only see how the queue changes over time since we do not know the initial size of the queue.

If this does not help, can you post some sample logs?

Chris

[chris]

You're welcome.

[RomainH]

Hi Chris,

Thank you this is just perfect !

Regards.
Romain