Hello Splunkers,
I would like to calculate below EPS values for 30 days time period for each source type on one combined search and i have individual searches but just want to see if i can get some thing here.
Average Event Size EPS (KBPS)
Max EPS (KBPS)
Average EPS (KB)
General EPS (KB)
If you're running the latest version, some of that info is on the Index Activity dashboard, and you can use that search as a start.
Change out the calc for measuring max, min, avg, etc
EG:
timechart avg(kbps) by series
timechart max(kbps) by series
kbps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(kbps) by series
eps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(eps) by series
If you wanted host or source, use group="per_source_thruput" or group="per_host_thruput" instead.
ah, one more suggestion... If you don't want to chart the results in a timeseries, you can swap out the timechart command with the stats command which may be a better fit for the solution you are looking for:
EG:
index="_internal" source=*metrics.log group="per_sourcetype_thruput" | stats avg(eps) by series
Thanks but i dont have access to DMC so that is why im looking for individual searches .
I just need calculate index=* sourcetype=* not from internal index
Use tstats and specify the variables:
• index=main
• earliest=-30d
• groupby (_time, sourcetype)
• span=1s
| tstats count as COUNT where index=main earliest=-30d by _time,sourcetype span=1s | timechart span=1h max(COUNT) as eps by sourcetype useother=f