Knowledge Management

What are best practices for setting polling intervals on each machine to collect system metrics?

josefa123
Explorer

Anyone of you has a best practice on implementing the best polling interval of each machine data? I am still puzzled on how to determine the polling rate of each. Make it too frequent, it will generate noise, make it too slow, it will reduce accuracy. Any help guys on what are the things that I need to consider?

Thank you so much

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

It depends on what you are going to do with the metrics and your use cases. If its about scheduling alert, minimum preferable interval should be 1-2 minutes. And then your polling interval should be adjusted to that.

For almost all the metrics , we are polling every 5 minutes for most of the system metrics and 1 day for ssl certificates, licenses etc which does not change in few minutes.

Refer here also

https://answers.splunk.com/answers/5136/time-interval-for-searches.html

https://wiki.splunk.com/Community:Best_practices_for_Splunk_alerting

Happy Splunking!

josefa123
Explorer

Thanks for your suggestions. But how can you say that you need data every 5 minutes? why not every 4? or 6? do you calculate data integrity over noise? I think what I need here is the proof why I choose the interval and why not something else.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Its completely depends on your requirement. For example polling interval for my disk space is every 5 minutes. Because i know there are no process which might right 100GB of data in 5 minutes. But it might not be your case. So depends on what you collect and how you use and for what purpose, it changes 🙂

Happy Splunking!
0 Karma

josefa123
Explorer

I appreciate your feedback and suggestion, but dont you guys have any framework on how do you determine each machine data that you are sampling? Thanks

0 Karma

josefa123
Explorer

Isn't it considered a "guess" when you just put x hour on this x machine data just because you know that it doesnt change every x minute?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Sorry but no we don't have any such framework

Happy Splunking!
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Are you referring to the system metrics like CPU,RAM,DISK etc?

Happy Splunking!
0 Karma

josefa123
Explorer

yes. Every machine data that needs to be monitored. How are guys determine what is the best polling rate of each? Do you have a computation or something?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...