[HOW TO] MPS per repo and per log source

  • 30 December 2021
  • 3 replies

Hello all,

I would like to visualize:

▶️ MPS sent by each log sources

▶️ MPS per repo_name


I have managed to create a timechart of MPS per repo_name:

repo_name=* | timechart count() by repo_name

Note : This is not really MPS per repos, but log volume per repo.


But I cannot find how to generate the equivalent for each log sources.


Thanks for your help!


Best answer by Nicolai Thorndahl 4 January 2022, 11:20

View original

3 replies

Userlevel 2
Badge +4

Try something like this
collected_at=* | timechart sum(1/300) as EPS by repo_name every 5 minutes 

Thank you for your answer. This seems working well :grinning:


To monitor my system I Build this Dashboard, maybe it can help you.

The first line of widgets takes data from _logpoint repo, most important, the rest you figure out Windows restart from thes repoes, Logpoint serveres againg from _logpoint and so on.

DashBoard funktionality.:

  • Witch device sends most events.
  • EPS pr DC and DMZ
  • Devices not sending
  • Collection types of data, and amount
  • Total EPS all repoes
  • Distribution of data on each DC
  • Logpoint Server restarted
  • Windows Server restarted
  • Logs pr server after Load Ballancer.
  • Last Widget keeps an eye on Support, and what they are doinge when loged in. ;)