peak time of log sources

[lohit]

Hi ,

I have some forwarders installed in my environment and want to calculate the peak time in which log sources forwarded the logs. I have around 15 Universal forwarders installed and looking to create a unified report for all the log sources peak time.(hourly basis). for example If my Log Source A, has send the maximum no of logs between 2-3 pm. SOme thing of that sort.

I would greatly appreciate any help.!!

Regards
Lohit

[jtrucks]

You can change the initial search to match what you need, but this works to get the top value, with 1h buckets, per host:

earliest="-1d@d" latest="-0d@d" index=_internal source=*license_usage.log type=Usage s="mylogsourcenamehere" | eval GB=b/1024/1024/1024 | bucket span=1h _time | stats sum(GB) AS GBsum by _time,h | sort -GBsum,h | dedup h

Enjoy.
Jesse

[lukejadamec]

You can use this to show the count (rough estimate of volume) by source:

index="*" source="*" host="*" |timechart span=1h count by source useother=false limit=50

Or, you can use this to show the count (rough estimate of volume) by host:

index="*" source="*" host="*" |timechart span=1h count by host useother=false limit=15

Use the buttons in the upper left to switch between chart and table view.

You can try this to show the count by hour, host, and source, but there is too much data for the chart.

index="*" source="*" host="*" | bucket _time span=1h |stats count by date_hour,host,source 

[davebrooking]

Lohit

You could use the license usage logs, something like the following will show how much is being indexed by each UF over time.

index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024| rename h as host | timechart span=1h sum(MB) AS IndexedMB by host

Dave

[lohit]

Also i am just looking in timeframe of 1hr(full 24 hrs) of previous day only.

[lohit]

the above command shows the usage of all the forwarder in a particular time frame. I was looking for only the the follwoing format

Source Peak Time Amount of Logs