Splunk Search

How to find the total and average indexing rates for all indexers?

Path Finder


Can I please know how to find the total indexing rate of all indexers and average indexing rate? Is there any query for it?

0 Karma

Splunk Employee
Splunk Employee

Hi keteng2024,

You can use the monitoring console to monitor the indexing rate.

  1. In Splunk Web, select Settings > Monitoring Console.
  2. From the Monitoring Control menu, select Indexing > Performance > Indexing Performance (Instance or Deployment).
  3. Select options and view the indexing rate of all indexers or all indexes.
  4. You can click the Open Search icon next to the indexing rate to view the query behind the statistics.

Here is a query example:

| rest splunk_server=hunter-mac-indexer /services/server/introspection/indexer
            | eval status = if((reason == ".") OR (reason == "") OR isnull(reason), status, status.": ".reason)
            | fields splunk_server, average_KBps, status
            | eval average_KBps = round(average_KBps, 0)
            | join [
              | rest splunk_server=<my_indexer_server> /services/properties/server/general/parallelIngestionPipelines]
            | fields splunk_server, value, average_KBps, status
            | rename splunk_server as Instance, value as "Pipeline Set Count", average_KBps as "Indexing Rate (KB/s)", status as Status, reason as Reason

Another example query to display indexing thruput:

index=_internal component=Metrics per_index_thruput
| eval mb=(kb/1024) | timechart span=1h sum(mb) by
series | addtotals

Hope it helps. Thanks!

0 Karma

Splunk Employee
Splunk Employee

A small correction - In my first example query, hunter-mac-indexer should be , the hostname of the server you are running your indexer.

0 Karma

Splunk Employee
Splunk Employee

Depending on what version you are running there may be a few places to look. That said the easiest and best place is probably the Monitoring Console, see link below for docs. If you want to run searches you can, see below for one example. There are a lot of answers already existing for ways to do that. There are quite a few different ways to get to the same data.

DMC - https://docs.splunk.com/Documentation/Splunk/6.5.1/DMC/DMCoverview

Search - https://answers.splunk.com/answers/154773/how-to-create-a-report-that-shows-max-indexed-volume-per-d...

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...