feature - Flex Object use cases library - New use cases splk_detect_daily_variations_volume_global / splk_detect_daily_variations_volume_index

trackme-limited / trackme-report-issues

The purpose of this repository is to allow Splunk community to report issues and enhancements requests

2 stars 0 forks source link

Closed guilhemmarchand closed 1 month ago

guilhemmarchand commented 1 month ago

feature - Flex Object use cases library - New use cases splk_detect_daily_variations_volume_global / splk_detect_daily_variations_volume_index

These two new use cases are designed to leverage the Splunk license indexing logs to track the daily absolute amount of data indexed globally on the license pool, and on a per index basis.
These KPIs then are used to train Outliers Models with the goal of detecting abnornal decrease/increase of indexing volume per entity.