Refine your search:

Is there anyway to count the number of searches ran on an indexer in a 24 hour period?

asked 16 Sep '10, 17:28

carmackd's gravatar image

carmackd
28712
accept rate: 21%


2 Answers:

The following gives you a total for all adhoc searches run in the past 24 hours:

index=_internal sourcetype="searches" earliest=-24h | stats count

And this one will give you a total for all searches, including saved searches run in the past 24 hours:

index=_internal (sourcetype="searches" OR SavedSplunker) earliest=-24h | stats count

And individual counts by user:

index=_internal (sourcetype="searches" OR SavedSplunker) earliest=-24h | stats count by user
link

answered 16 Sep '10, 17:43

ftk's gravatar image

ftk ♦
6.2k419
accept rate: 37%

In the Search App in the Status > Search activity dashboards in Splunk 4.1.x there are dashboards containing the following searches:

Search load over time (last 24 hours)
Search count by user (last 24 hours)
Run time by user (last 24 hours)
Common searches (last hour)
CPU Utilization due to searches
etc.

If you have SplunkWeb running on the indexer these dashboards will display results for that indexer. I'm not sure if these dashboards are built out of the box for distributed search though.

link

answered 16 Sep '10, 18:58

hulahoop's gravatar image

hulahoop ♦
2.5k3240
accept rate: 40%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×1,090
×63

Asked: 16 Sep '10, 17:28

Seen: 628 times

Last updated: 16 Sep '10, 18:58

Copyright © 2005-2012 Splunk, Inc. All rights reserved.