Answers for "Looking at Queue Fill ratios in DMC - which aggregation?"
https://answers.splunk.com/answers/612208/looking-at-queue-fill-ratios-in-dmc-which-aggregat.html
The latest answers for the question "Looking at Queue Fill ratios in DMC - which aggregation?"Answer by eregon
https://answers.splunk.com/answering/743337/view.html
There is no general consensus / best practice on what to use, it depends on what you want to find out. To choose the aggregation properly, you need to understand what it means. Actually, it is just pure maths.
Splunk has fill ratio values on per minute basis (or maybe per every few seconds, I am not sure about that), however the graph presents them *aggregated*. That means several values in Splunk logs (all values in certain time window, that means per 5min, per 1h, per 1d, ...) are *aggregated* into one single value presented to user in graph.
In another words, if you choose to display maximum, you will get the upper limit: you know the queue fill ratio did not exceed this value during the respective timeframe. It could be useful, let's say, to prove your hardware is such an overkill that your queues can never ever get full.
To check you have no I/O trouble, average/median/90percentile are much more appropriate.Tue, 30 Apr 2019 12:21:16 GMTeregon