Reporting

Query Events rate by host

gfriedmann
Communicator

I'm trying to query events per host over a certain time period. Event rate, or events per second, by HOST. I'd like a table of "Of all hosts, this is the message count for 1) Last 1 minute, 2) Last 5 mins, 3) Last 15 minutes.

Ultimately, i'd like a little graph of eventrate over time for multiple hosts. This would help me visually identify which hosts are suddenly responsible for many more events than usual.

I feel like this might be in metadata somewhere. (new user, so i'm not very familiar).

Tags (3)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I think the best starting point, and with pretty low effort, is just this.

Go to the 'Advanced Charting View' and run the following:

index=_internal source=*metrics.log group=per_host_thruput | timechart sum(kb) avg(eps) by series

A more brute force way to do something similar (since you only want the count of events anyway) is to just run

* | timechart count by host

View solution in original post

sideview
SplunkTrust
SplunkTrust

I think the best starting point, and with pretty low effort, is just this.

Go to the 'Advanced Charting View' and run the following:

index=_internal source=*metrics.log group=per_host_thruput | timechart sum(kb) avg(eps) by series

A more brute force way to do something similar (since you only want the count of events anyway) is to just run

* | timechart count by host

EmanueleR
New Member

Hi, 

Like the splunk training teaches, a wildcard before a name field is bad practise. 

It's important to use wildcards always before,  so neither in the middle.

0 Karma

gfriedmann
Communicator

Found the answer when searching for "volume"

http://answers.splunk.com/questions/140/how-do-i-determine-my-indexing-volume-by-host-source-or-sour...

per host metrics are also included in the var/log/splunk/metrics.log . Search for "group=per_host_thruput"

Now, to get to the visual representation....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...