Splunk Search

How to find the total and average indexing rates for all indexers?

Path Finder


Can I please know how to find the total indexing rate of all indexers and average indexing rate? Is there any query for it?

0 Karma

Splunk Employee
Splunk Employee

Hi keteng2024,

You can use the monitoring console to monitor the indexing rate.

  1. In Splunk Web, select Settings > Monitoring Console.
  2. From the Monitoring Control menu, select Indexing > Performance > Indexing Performance (Instance or Deployment).
  3. Select options and view the indexing rate of all indexers or all indexes.
  4. You can click the Open Search icon next to the indexing rate to view the query behind the statistics.

Here is a query example:

| rest splunk_server=hunter-mac-indexer /services/server/introspection/indexer
            | eval status = if((reason == ".") OR (reason == "") OR isnull(reason), status, status.": ".reason)
            | fields splunk_server, average_KBps, status
            | eval average_KBps = round(average_KBps, 0)
            | join [
              | rest splunk_server=<my_indexer_server> /services/properties/server/general/parallelIngestionPipelines]
            | fields splunk_server, value, average_KBps, status
            | rename splunk_server as Instance, value as "Pipeline Set Count", average_KBps as "Indexing Rate (KB/s)", status as Status, reason as Reason

Another example query to display indexing thruput:

index=_internal component=Metrics per_index_thruput
| eval mb=(kb/1024) | timechart span=1h sum(mb) by
series | addtotals

Hope it helps. Thanks!

0 Karma

Splunk Employee
Splunk Employee

A small correction - In my first example query, hunter-mac-indexer should be , the hostname of the server you are running your indexer.

0 Karma

Splunk Employee
Splunk Employee

Depending on what version you are running there may be a few places to look. That said the easiest and best place is probably the Monitoring Console, see link below for docs. If you want to run searches you can, see below for one example. There are a lot of answers already existing for ways to do that. There are quite a few different ways to get to the same data.

DMC - https://docs.splunk.com/Documentation/Splunk/6.5.1/DMC/DMCoverview

Search - https://answers.splunk.com/answers/154773/how-to-create-a-report-that-shows-max-indexed-volume-per-d...

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...