I have an input value that changes steadily (at constant rate, either increasing or decreasing), and Splunk is capturing every value with a timestamp. I am trying to find a way to calculate the acceleration of this input, which is the rate of change over time. Ideally, I would like to trigger an alert if a threshold in this rate of change is reached. Any smooth changes in the velocity are fine, but abrupt changes (speed up, slow down larger than some threshold) should trigger an alarm, or at least should be visible in a Splunk graph for analysis against other kind of time based data for event correlation analysis. Mathematically, the problem should be simple: Acceleration is the second derivative of a function. However, it is difficult to model a function (much less find the derivatives) from just raw data. I might be over-thinking this, therefore I'm reaching out to other splunkers for ideas. Thanks. ... View more

We have some log files that we monitor as heartbeat for some daemon processes. These files contain a large level of verbosity and tend to be quite large. It turns out that we do not need to index the content, but we need to monitor that the files keep changing, either because of content or log rotation and creation of a new empty file with the same name. We put few monitor:// lines in our inputs.conf and all has been fine for some time, but the processes that write these logs sometimes produce excessive debug information that is not required be indexed at all. These bursts of data have tripped our daily volume quota twice in a quarter, leaving us with no indexing for almost half a day. We asked our users and even searched our _internal splunk logs and nobody has ever searched any content on those files. On the other hand, the alert when there has been no events on the monitors for some time has been proved very useful. The reason I am posting this question is whether anyone knows of a way to monitor for a file size change and/or last modification time, that does not index anything of the file contents, but only the size of the file. We still need to run a search with an alert if the size of the file has not changed during a time interval. Thanks. ... View more