Splunk Search

use splunkd metrics eps and 7 day average

EricPartington
Communicator

I would like start setting baselines for devices that are sending logs to splunk.
An example:
using splunkd metrics group_by_host
chart the last 24 hours using span of 1hr the average eps value by host

index=_internal sourcetype=splunkd metrics group="per_host_thruput" series=server1 | timechart span=1h avg(eps) by series

on top of that i would like to chart the 7day average value of eps for that same host as a constant on the same chart (-7d@d to -d@d)
Initially using the raw data, eventually using summary index for storing the hourly or daily average(eps) to report quickly (using hourly for last 7dx24hr or daily for last 7 days).
looking to eventually use this to show if traffic patterns are above normal (trending for last 7d, 30d etc). also reporting for traffic above or below normal for extended period of time.
thoughts ?

have looked at trendline, streamstats and appending a static value but cant seem to get started on the right path.

0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

I would (strongly) recommend taking a look at the Deployment Monitor app that now ships with Splunk. It contains very detailed statistics and dashboards/charts on forwarders, indexers, throughput, searches, license usage, volume reporting etc. It will also give you ideas on creating customized charts.
Link: http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

_d_
Splunk Employee
Splunk Employee

I would (strongly) recommend taking a look at the Deployment Monitor app that now ships with Splunk. It contains very detailed statistics and dashboards/charts on forwarders, indexers, throughput, searches, license usage, volume reporting etc. It will also give you ideas on creating customized charts.
Link: http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

EricPartington
Communicator

already using deployment monitor successfully

thanks for the hints on using that as a template to change.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...