Get Sourcetype and Index Info via TSTATS

Use the following simple tstats query to return the latest time events came in for a given index as well as list all sourcetypes for each index:

Continue Reading →

Universal Forwarder Splunk Versions

Returns the version of Splunk Universal Forwarders in an environment via _internal logs.

Continue Reading →

License Usage Prediction

There is an older Splunk query here that had previously predicted license usage. I’m not sure why (perhaps the predict command has changed since the original post in 2015?), but the query is no longer working. I’ve updated the query to predict Splunk license usage using the Splunk predict command as shown below:

 

Continue Reading →

Saved Search Scheduler Activity

I use this query a lot to tune and adjust scheduling, find out what searches need attention:

 

Continue Reading →

Show indexing queue sizes

Use a linechart with this search to show you the indexing queue sizes:

Continue Reading →

Percentage of skipped searches

This query will give you a table with a percentage of skipped searches and an evaluation with 3 ranges

Continue Reading →

Show Splunk User to Role mapping

The following Splunk REST query shows all roles, number of  capabilities, and landing app for each user.

Continue Reading →

Bucket Count by indexer/index

This search displays the amount of buckets per indexer/index To learn more about the | dbinspect command go to: http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Dbinspect

Continue Reading →

Bucket Count by State over Index

This search counts the amount of buckets per state for each index. To learn more about | dbinspect go to: http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Dbinspect

Continue Reading →

Memory Usage (MB) per Splunk Process Class

Use the following search with a column chart visualisation. It will give you a good overview of what Splunk processes use the most memory:

Continue Reading →

Universal Forwarder Throughput Limit Hit Count

This search counts the amount of times the UF’s throughput limit is hit. I also threw in a sparkline:

Continue Reading →

Top 10 Accessed Dashboards

Where “host=”your_sh_host”” you could specify a host, or put a wildcard * in place.

Continue Reading →

Universal Forwarder Throughput Statistics

This search creates a table to list all  Universal Forwarders. There is also an eval in there that classifies hosts based on their average Kbps. You can modify this as needed.

Continue Reading →

Average Search Duration

Ever wonder how your search performance is across search heads? Try this query. Depending on your environment you’ll want to specify the host=* section to better represent your environment. Say if you have a naming convention that includes “shc” and a number representing searchheads in a cluster (distributed environment) you can use (host=shc1.fq.dn OR host=shc2.fq.dn […]

Continue Reading →

Search for all errors in splunkd

Continue Reading →

Detect Scheduler Running Twice a Search

There is a bug that make a search being executed 2 times or more.

Continue Reading →

Find queues that are nearly full

Easily find Splunk Instances (both forwarders and full installs) that have queues that are over 80% full!

Continue Reading →

License Usage by Pool per hour for last 24 hours

Have a misbehaving License Pool that the admin swears he fixed this morning?

Continue Reading →