Splunk Search

Search for daily indexing rate per sourcetype and list the specific indexes

mpham07
Path Finder

Hello all,

I just came onto a new job and we're trying to figure out the daily indexing rate broken down by sourcetypes. Then we're going to get the average for X days. Is there another search that can list the throughput of each sourcetype within an index? I like the search below for per_sourcetype_thruput, but it doesn't list the indexes. I tried looking at the per_index_thruput to figure it out too but am now stuck trying to see if there are other commands out there that can help.

 index=_internal component=Metrics per_sourcetype_thruput
 | eval mb=kb/1024 
 | timechart span=1d sum(mb) by series useother=f limit=150

 index=_internal component=Metrics per_index_thruput
 | eval mb=(kb/1024) 
 | timechart span=1d sum(mb) by series useother=f limit=100

Thank you for your time, take care.

0 Karma
1 Solution

nareshinsvu
Builder

try this? This gives volume usage stats for the index and sourcetype on daily basis

index=_internal source="*license_usage.log*" type=Usage  | eval yearmonthday=strftime(_time, "%Y%m%d") | stats sum(eval(b/1024/1024)) AS volume_mb by idx st yearmonthday

View solution in original post

nareshinsvu
Builder

try this? This gives volume usage stats for the index and sourcetype on daily basis

index=_internal source="*license_usage.log*" type=Usage  | eval yearmonthday=strftime(_time, "%Y%m%d") | stats sum(eval(b/1024/1024)) AS volume_mb by idx st yearmonthday

mpham07
Path Finder

Thank you nareshinsvu! It worked perfectly.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...