Splunk Search

use splunkd metrics eps and 7 day average

EricPartington
Communicator

I would like start setting baselines for devices that are sending logs to splunk.
An example:
using splunkd metrics group_by_host
chart the last 24 hours using span of 1hr the average eps value by host

index=_internal sourcetype=splunkd metrics group="per_host_thruput" series=server1 | timechart span=1h avg(eps) by series

on top of that i would like to chart the 7day average value of eps for that same host as a constant on the same chart (-7d@d to -d@d)
Initially using the raw data, eventually using summary index for storing the hourly or daily average(eps) to report quickly (using hourly for last 7dx24hr or daily for last 7 days).
looking to eventually use this to show if traffic patterns are above normal (trending for last 7d, 30d etc). also reporting for traffic above or below normal for extended period of time.
thoughts ?

have looked at trendline, streamstats and appending a static value but cant seem to get started on the right path.

0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

I would (strongly) recommend taking a look at the Deployment Monitor app that now ships with Splunk. It contains very detailed statistics and dashboards/charts on forwarders, indexers, throughput, searches, license usage, volume reporting etc. It will also give you ideas on creating customized charts.
Link: http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

_d_
Splunk Employee
Splunk Employee

I would (strongly) recommend taking a look at the Deployment Monitor app that now ships with Splunk. It contains very detailed statistics and dashboards/charts on forwarders, indexers, throughput, searches, license usage, volume reporting etc. It will also give you ideas on creating customized charts.
Link: http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

EricPartington
Communicator

already using deployment monitor successfully

thanks for the hints on using that as a template to change.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...