All Apps and Add-ons

Fire Brigade Feature Request: Please add events per bucket metric

bandit
Motivator

Great app! I already see bucket counts, bucket, size, etc. I'd like to see an events per bucket metric, especially since this factors into whether or not buckets qualify for report acceleration.

Thanks,

Rob

0 Karma

sowings
Splunk Employee
Splunk Employee

How about the "eventCount" field from | dbinspect?

0 Karma

ppablo
Retired

FYI, Fire Brigade version 2 will no longer be updated (latest version is 2.0.3). The newer versions 2.0.4 and higher will now be available with the original “Fire Brigade” app on Splunkbase which was just updated to support Splunk 6.3. This is noted on the page for Fire Brigade on Splunkbase:
https://splunkbase.splunk.com/app/1581/

If you have any questions, ping the developer of the app @sowings

Cheers!

0 Karma

bandit
Motivator

Something like:

index=myindex | eval bucket_event_id=_cd | rex field=bucket_event_id "(?<bucket_id>[^:]+):" | stats count by index sourcetype splunk_server bucket_id | sort splunk_server bucket_id
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...