diff --git a/criblvision-for-splunk/criblvision/README b/criblvision-for-splunk/criblvision/README index 9835c0a..a5dbe53 100644 --- a/criblvision-for-splunk/criblvision/README +++ b/criblvision-for-splunk/criblvision/README @@ -144,6 +144,13 @@ This app ships with a number of disabled alerts that can be used to alert when i +### Reports - Summary Indexing + +This app contains the ability to summarize Cribl's internal metrics on data throughput in order to provide a historical reference for metrics that is readily accessible and performant. These searches summarize total bytes and events by input and output which allows for a look at per-component look at data thruput. Turn these searches on to enable use of the Cribl Thruput Summary dashboard: + +* Summary Gen - Cribl Thruput - Inputs +* Summary Gen - Cribl Thruput - Outputs + ### The CriblVision for Splunk Pack The CriblVision for Splunk Pack is a companion to this Splunk app. It **is not** a requirement to use the Pack to receive value from this app. The Pack is only required if you would like to take advantage of the Collector Jobs that the Pack provides templates for. diff --git a/criblvision-for-splunk/criblvision/default/data/ui/views/cribl_thruput_summary.xml b/criblvision-for-splunk/criblvision/default/data/ui/views/cribl_thruput_summary.xml new file mode 100644 index 0000000..3ec0623 --- /dev/null +++ b/criblvision-for-splunk/criblvision/default/data/ui/views/cribl_thruput_summary.xml @@ -0,0 +1,179 @@ +
+ + Cribl Thruput Stats by Input and Output. Note that to enable the summaries for this dashboard, you must enable the two Summary Indexing searches in this app that start with "Summary Gen - Cribl Thruput" + + + +
+ + + + -30d@d + @d + + + + + auto + 5s + 10s + 30s + 1m + 5m + 10m + 30m + 1h + 1d + 1w + 1mon + auto + + if($value$ == "auto", "", "span=".$value$) + "span=".$value$ + + span= + auto + +
+ + + + + All + " + " + , + + + field + field + + `set_cribl_internal_log_index` source=cribl_thruput_summary component=output +| stats values(out_bytes_*) AS * +| fieldsummary +| table field + -48h@h + now + + + + Cribl Total Output Events + + `set_cribl_internal_log_index` source=cribl_thruput_summary component=output +| timechart max(out_events_*) AS * +| table _time, $output_token$ + $global_time_tok.earliest$ + $global_time_tok.latest$ + + + + + + + + + + + + + + + + + + + + Cribl Total Output Bytes + + `set_cribl_internal_log_index` source=cribl_thruput_summary component=output +| timechart max(out_bytes_*) AS * +| table _time, $output_token$ + $global_time_tok.earliest$ + $global_time_tok.latest$ + + + + + + + + + + + + + + + + + + + + + + Inputs + + + " + " + , + + + field + field + + `set_cribl_internal_log_index` source=cribl_thruput_summary component=input +| stats values(in_bytes_*) AS * +| fieldsummary +| table field + -48h + now + + + + Cribl Total Input Events + + `set_cribl_internal_log_index` source=cribl_thruput_summary component=input +| timechart max(in_events_*) AS * +| table _time, $input_token$ + $global_time_tok.earliest$ + $global_time_tok.latest$ + + + + + + + + + + + + + + + + + Cribl Total Input Bytes + + `set_cribl_internal_log_index` source=cribl_thruput_summary component=input +| timechart max(in_bytes_*) AS * +| table _time, $input_token$ + $global_time_tok.earliest$ + $global_time_tok.latest$ + + + + + + + + + + + + + + + +
\ No newline at end of file diff --git a/criblvision-for-splunk/criblvision/default/savedsearches.conf b/criblvision-for-splunk/criblvision/default/savedsearches.conf index 11515d2..4e389e2 100644 --- a/criblvision-for-splunk/criblvision/default/savedsearches.conf +++ b/criblvision-for-splunk/criblvision/default/savedsearches.conf @@ -429,4 +429,52 @@ request.ui_dispatch_app = criblvision request.ui_dispatch_view = search search = `set_cribl_internal_log_index` `set_cribl_log_sourcetype` message="restarting worker process"\ | stats count AS worker_process_restarts BY host instance_type worker_group\ -| where worker_process_restarts > `set_alert_threshold_worker_process_restarts` \ No newline at end of file +| where worker_process_restarts > `set_alert_threshold_worker_process_restarts` + +### Summary Indexing Searches ### + +[Summary Gen - Cribl Thruput - Inputs] +alert.track = 0 +cron_schedule = 0 1 * * * +description = Generates a summary index of cribl thruput statistics for the inputs of cribl. +disabled = 1 +dispatch.earliest_time = -1d@d +dispatch.latest_time = @d +enableSched = 1 +request.ui_dispatch_app = criblvision +request.ui_dispatch_view = search +search = | mstats sum(`set_cribl_metrics_prefix(total.in_bytes)`) sum(`set_cribl_metrics_prefix(total.in_events)`) prestats=true WHERE `set_cribl_metrics_index` span=auto BY input\ +| timechart span=1d limit=0 sum(`set_cribl_metrics_prefix(total.in_bytes)`) AS in_bytes sum(`set_cribl_metrics_prefix(total.in_events)`) AS in_events useother=false BY input\ +| fields - _span*\ +| rename *:* AS *_*\ +| rename *:* AS *_*\ +| rename *:* AS *_*\ +| rename "* *" AS **\ +| foreach in_bytes_kinesis* \ + [eval in_bytes_kinesis=0, in_bytes_kinesis=sum(in_bytes_kinesis, <>)]\ +| foreach in_events_kinesis* \ + [eval in_events_kinesis=0, in_events_kinesis=sum(in_events_kinesis, <>)]\ +| fields - in_*_kinesis_*\ +| fillnull value=0\ +| eval component="input"\ +| collect `set_cribl_internal_log_index` source="cribl_thruput_summary" + +[Summary Gen - Cribl Thruput - Outputs] +alert.track = 0 +cron_schedule = 0 1 * * * +description = Generates a summary index of cribl thruput statistics for the outputs of cribl. +disabled = 1 +dispatch.earliest_time = -1d@d +dispatch.latest_time = @d +enableSched = 1 +request.ui_dispatch_app = criblvision +request.ui_dispatch_view = search +search = | mstats sum(`set_cribl_metrics_prefix(total.out_bytes)`) sum(`set_cribl_metrics_prefix(total.out_events)`) prestats=true WHERE `set_cribl_metrics_index` span=auto BY output\ +| timechart span=1d limit=0 sum(`set_cribl_metrics_prefix(total.out_bytes)`) AS out_bytes sum(`set_cribl_metrics_prefix(total.out_events)`) AS out_events useother=false BY output\ +| fields - _span*\ +| rename *:* AS *_*\ +| rename *:* AS *_*\ +| rename "* *" AS **\ +| fillnull value=0\ +| eval component="output"\ +| collect `set_cribl_internal_log_index` source="cribl_thruput_summary"\ \ No newline at end of file