Splunk Search

How to write a search to check the amount of data indexed by my app each day for a certain time range?

sushmitha_mj
Communicator

Hi,

I want to a graph to check the amount of data indexed by my app on each day for a certain time period. I have multiple csv files in the source, one host and an index ( not default, I created this ). I used

index="abc" | eval MB=kb/1024 | search group="per_sourcetype_thruput" | timechart span=1d sum(MB) by series 

and

index="abc" group="per_index_thruput" | timechart per_second(kb) as " kbps" by series 

but they seem to return no results.

Tags (3)
0 Karma
1 Solution

lguinn2
Legend

The groups that you are looking for are not in the "abc" index - they are in the _internal index. Also, you can get the "per index" through-put by index, or the "per sourcetype" through-put by sourcetype - but you can't get the "per index" through-put by sourcetype!

index=_internal sourcetype=splunkd group=per_sourcetype_thruput
| eval MB=kb/1024 | timechart span=1d sum(MB) by series

index=_internal sourcetype=splunkd group=per_index_thruput series="abc"
|timechart per_second(kb) as " kbps"

HTH

View solution in original post

lguinn2
Legend

The groups that you are looking for are not in the "abc" index - they are in the _internal index. Also, you can get the "per index" through-put by index, or the "per sourcetype" through-put by sourcetype - but you can't get the "per index" through-put by sourcetype!

index=_internal sourcetype=splunkd group=per_sourcetype_thruput
| eval MB=kb/1024 | timechart span=1d sum(MB) by series

index=_internal sourcetype=splunkd group=per_index_thruput series="abc"
|timechart per_second(kb) as " kbps"

HTH

sushmitha_mj
Communicator

@Iguinn
Thank you...
Both worked, and I had an option of entering the series on the first one as well. As the graph itself was multiple series lines.

0 Karma

sushmitha_mj
Communicator

@Iguinn
I have a doubt... When I added the query "index=_internal sourcetype=splunkd group=per_host_thruput | timechart per_second(kb) by series" to the dashboard made a default time range of 365 days, I get a different graph and when I run it for All time it is different. Although the data is only there starting march. Any idea why?

0 Karma

lguinn2
Legend

Well, if you run the same search twice, you will get different results usually, as the data is always changing.
But, there is also the problem of the first/final "grouping" of the data - if the data is only partial days, it can look weird. And different timeranges can certainly make the graph look different.

I would probably set the search time range explicitly to something like earliest=-30d@d latest=@d to avoid the problem of partial buckets. Or, if you want to be able to pick the timerange each time you run the report, do this in the timechart command:

timechart fixedrange=f partial=f per_second(kb) as " kbps"

This will restrict the graph to only the part of the timerange with valid data and also remove any partial buckets.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...