topic How to find out the GB/Day of data ingestion not using license data query? in Splunk Enterprise

How to find out the GB/Day of data ingestion not using license data query?

scottj1y — Tue, 11 Jul 2023 17:47:00 GMT

Hi, I've been trying to piece together a query that a power user could run that could report the GB/Day of data indexed for a particular index without having to access the license usage data (which a power user wouldn't have access to).

I've been trying to leverage the dashboards in the Monitoring app but nothing seems to be quite what I need. I'd like to get the deployment wide GB/day indexed for a single index which seems easy but so far I haven't been able to crack it.

Any suggestions?

Re: How to find out the GB/Day of data ingestion not using license data query?

meetmshah — Wed, 12 Jul 2023 19:16:06 GMT

In any case, power user won't have access to the _internal index. You can either calculate the usage based on individual index like " | eval event_size=if(isnotnull(len(_raw)), len(_raw), 0) | stats sum(event_size) as total_bytes by sourcetype | eval total_gb=round(total_bytes/1024/1024/1024, 3)"

Create a saved search through the admin user which updates the lookup (or summary index) with ingestion details and let power users access that lookup / summary index for Dashboard panels.

The last option would be easy to manage and suggested.

Please accept the answer if that helps!

Re: How to find out the GB/Day of data ingestion not using license data query?

scottj1y — Wed, 12 Jul 2023 19:34:57 GMT

Let me check that out and I will mark it gratefully. 😀