Splunk Search

Is there a way to show the number of events per distinct count of servers over time?

wzgoda
Explorer

For my data set, I am looking to see the sum of the number of events per distinct count of servers. Reasoning, I am looking at a data set that has a large increase in volume near increase in Splunk indexing servers. I wanted to see if the increase of Splunk indexers could be the cause of the increase in volume. Any additional insight is appreciated.

Thanks in advance

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Some extra (and possibly faster) fun searches:

| tstats prestats=t count WHERE index=* BY _time host span=1d | timechart span=1d count by host

If you needed that by indexer, you can try something like:

| tstats prestats=t count WHERE index=* BY _time splunk_server span=1d | timechart span=1d count by splunk_server
0 Karma

lycollicott
Motivator

It's possible that your new indexer is collecting something that you aren't aware of, but it's hopefully some other machine and not your indexer. Run this search on the time range just before & after you noticed the increase. (It could be a long search if you have a large environment, so you may want to run it in the background.)

index=* | timechart span=1d count by host

If you have a huge number of hosts then you may need to include the limit and useother parameters, too.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=* | timechart span=1d count by splunk_server limit=0 useother=f | addtotals
0 Karma

lycollicott
Motivator

Do you mean that you added a new indexer to an indexer cluster and at the same time you noticed that you were indexing a greater number of events?

0 Karma

wzgoda
Explorer

close.... I added a new indexer and after a short period of time the volume increased. My boss is grilling me for the ration of events per server over time so I just want to get that for her.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...