Splunk Search

Is there a way to show the number of events per distinct count of servers over time?

wzgoda
Explorer

For my data set, I am looking to see the sum of the number of events per distinct count of servers. Reasoning, I am looking at a data set that has a large increase in volume near increase in Splunk indexing servers. I wanted to see if the increase of Splunk indexers could be the cause of the increase in volume. Any additional insight is appreciated.

Thanks in advance

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Some extra (and possibly faster) fun searches:

| tstats prestats=t count WHERE index=* BY _time host span=1d | timechart span=1d count by host

If you needed that by indexer, you can try something like:

| tstats prestats=t count WHERE index=* BY _time splunk_server span=1d | timechart span=1d count by splunk_server
0 Karma

lycollicott
Motivator

It's possible that your new indexer is collecting something that you aren't aware of, but it's hopefully some other machine and not your indexer. Run this search on the time range just before & after you noticed the increase. (It could be a long search if you have a large environment, so you may want to run it in the background.)

index=* | timechart span=1d count by host

If you have a huge number of hosts then you may need to include the limit and useother parameters, too.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=* | timechart span=1d count by splunk_server limit=0 useother=f | addtotals
0 Karma

lycollicott
Motivator

Do you mean that you added a new indexer to an indexer cluster and at the same time you noticed that you were indexing a greater number of events?

0 Karma

wzgoda
Explorer

close.... I added a new indexer and after a short period of time the volume increased. My boss is grilling me for the ration of events per server over time so I just want to get that for her.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...