Skip to content

Instantly share code, notes, and snippets.

@neilstuartcraig

neilstuartcraig/splunk-search-server-logging-excessive-data

Created October 18, 2013 08:00
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save neilstuartcraig/7038037 to your computer and use it in GitHub Desktop.
Save neilstuartcraig/7038037 to your computer and use it in GitHub Desktop.
Download ZIP
A splunk search which you can schedule and alert on (e.g. if number of events > 0) to let you know if any of your servers are generating large volumes of log data. We use this at work in a suite of alerts which help us identify problems or potential security violations quickly and easily. To this end, you'll probably want to add to this search t…
Raw
splunk-search-server-logging-excessive-data
index="_internal" source="*metrics.log" per_host_thruput | chart sum(kb) by series | rename sum(kb) to KBLogged | eval MBLogged=round(KBLogged/1024,1) | fields series MBLogged | search MBLogged>3 | sort -MBLogged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment