topic Re: How much are we indexing per index in Getting Data In

How much are we indexing per index

bohrasaurabh — Mon, 03 Feb 2014 19:31:38 GMT

How can I query how much data are we indexing per index for last 7 days. We are on Splunk 6.0.1

Re: How much are we indexing per index

lukejadamec — Mon, 03 Feb 2014 19:41:29 GMT

You can something try this:

index=_internal source=*metrics.log group=per_index_thruput series!="_*" | eval totalGB = (kb/1024)/1024 | timechart span=7d sum(totalGB)

Re: How much are we indexing per index

bohrasaurabh — Mon, 28 Sep 2020 15:48:13 GMT

I am looking for a query which can output index and its usage. Something like below
name day1 day2 day3 day4 day5 day6 day7
index_a 1.2 1.3 1.5 1.1 1.7 0.9 1.1
index_b 3.2 3.2 3.5 3.7 4.0 3.2 3.2

Re: How much are we indexing per index

somesoni2 — Tue, 04 Feb 2014 20:52:45 GMT

Try this

index=_internal source=*metrics.log group=per_index_thruput series!="_*"  | bucket span=1d _time  | eval totalMB = round(kb/1024,4) | eval Date=strftime(_time,"%Y-%m-%d") | chart sum(totalMB) over series by Date