Cribl Thruput Summary Dashboard & Reports

[arcsector]

Summary of Changes

Added:

• Saved Searches:
  • Summary Gen - Cribl Thruput - Inputs
  • Summary Gen - Cribl Thruput - Outputs
• Dashboard/View: Cribl Thruput Summary
• Readme section explainer

Change details

This PR is an enhancement PR that enables the ability to summarize Cribl's internal metrics on data throughput in order to provide a historical reference for metrics that is readily accessible and performant. These searches summarize total bytes and events by input and output which allows for a look at per-component look at data thruput through the attached dashboard.

Purpose of this feature

This feature is desirable because:

• Cribl's internal stats are not slim enough to search over 30+ days easily. Summary Searching makes this easy to store the data at low cost and then reference it later for reporting purposes
• It gives a Delta between splunk's internal reporting of data received and what data Cribl thinks it has sent
• It allows users to troubleshoot per-component data issues.
• It is a generic window into the world of Cribl statistics and is a good compliment to the other features in this app