topic Re: Total number of indexed volume per day in Getting Data In

Total number of indexed volume per day

apro — Mon, 21 Jun 2010 15:18:01 GMT

Hi,

Currently I have a splunk server receiving logs from few servers.

I will like to do a search that is scheduled on a daily basis which will report on the total indexed volume for all servers in a day.

This command looks good but it list individual servers and their indexed size: index=_internal source=*metrics.log splunk_server="*" | eval MB=kb/1024 | search group="per_host_thruput" | chart sum(MB) by series | sort sum(MB)

Thanks

Re: Total number of indexed volume per day

Simeon — Mon, 21 Jun 2010 23:45:54 GMT

You simply need to use the addtotals command:

index=_internal source=*metrics.log splunk_server="*" | eval MB=kb/1024 | search group="per_host_thruput" | chart sum(MB) by series | addtotals

Re: Total number of indexed volume per day

apro — Wed, 23 Jun 2010 17:10:46 GMT

Thanks for the tip.works fine and got to display the total volume.Can advise further on the Custom Alert condition search to specify if I only want to receive an email if the total indexed volume hit 70% of the license limit?

Re: Total number of indexed volume per day

Simeon — Wed, 23 Jun 2010 22:11:50 GMT

I can help answer your question, but for sharing purposes, can you create a new question? It's a modified search and it uses additional operators.

Re: Total number of indexed volume per day

apro — Thu, 24 Jun 2010 13:01:44 GMT

Hi, have created new question here ->

http://answers.splunk.com/questions/3976/custom-alert-condition-search-to-report-on-indexed-volume

thanks.

Re: Total number of indexed volume per day

apro — Fri, 25 Jun 2010 13:18:25 GMT

Some updates,

I am scheduling this search(Daily Indexed Volume) now:

but it seems to be generating the following errors:

in splunkd.log: 06-25-2010 10:04:27.285 ERROR stats - The argument '>' is invalid.

in scheduler.log: 06-25-2010 10:04:27.285 ERROR SavedSplunker - savedsearch_id="myuserid;search;Daily Indexed Volume", Error in 'stats': The argument '>' is invalid.

Any idea??

Re: Total number of indexed volume per day

sloshburch — Mon, 11 Feb 2013 16:47:25 GMT

Is it because the parens in the Host(s)? Perhaps you need quotes or to escape it? I would try renaming that and give it another crack to isolate the issue.

Re: Total number of indexed volume per day

mendesjo — Wed, 24 Feb 2016 23:46:48 GMT

another query posted and another that doesnt work.. for me anyway.