How can I calculate in real-time the rate of events (eps) being indexed?

1	I would like to find out how many events per second my indexer is receiving and indexing. What search could help me find this out? indexing eps asked 23 Sep '11, 08:31 hexx ♦ 7.5k●1●9●41 accept rate: 51% edited 07 Oct '11, 00:40

One Answer:

oldest newest most voted

Run the following search over the time range real-time(all time) and you will be able to see what your incoming event rate looks like :

index=savage_clowns | eval search_time=now() | eval seconds_elapsed=(time() - search_time) | eval secs=if(seconds_elapsed<0,"1",seconds_elapsed) | stats count as ecount, last(secs) AS seconds| stats last(ecount) AS "event count", last(seconds) AS "search seconds elapsed", last(eval(ecount/seconds)) AS eps

This example targets a specific index, but feel free to change the first search terms to better suit your needs.

link

answered 23 Sep '11, 08:35

hexx ♦
7.5k●1●9●41
accept rate: 51%

edited 23 Sep '11, 08:47

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

indexing ×326
eps ×8

Asked: 23 Sep '11, 08:31

Seen: 527 times

Last updated: 20 Feb, 06:58

How can I calculate in real-time the rate of events (eps) being indexed?

Follow this question

Splunk Resources

Related questions