topic Re: Is there a way to determine how much disk space my sourcetype is taking up? in Getting Data In

Is there a way to determine how much disk space my sourcetype is taking up?

a212830 — Wed, 15 Oct 2014 22:13:35 GMT

Hi,

Is there a way to determine how much disk space a sourcetype is using?

Re: Is there a way to determine how much disk space my sourcetype is taking up?

jlanders — Mon, 28 Sep 2020 17:55:22 GMT

So here's one option. You can see how much data you are indexing for a given time period per sourcetype. The general rule for Splunk disk storage is 1/2 X Indexing X Days. Example: 1/2 X 5 gb X 365 days = 912.5 GB of storage.

index=internal metrics kb series!=* "group=per_sourcetype_thruput" | stats sum(indexed_mb) by series

Another option might be using the dbinspect command:

| dbinspect index=my_index

If you can estimate the percentage of the index your sourcetype takes up, you can can an accurate estimate of the disk usage. Reference: http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Dbinspect

Re: Is there a way to determine how much disk space my sourcetype is taking up?

awurster — Mon, 08 Dec 2014 23:57:43 GMT

in 6.1 that didn't seem to work at all for me. i found success with the following:

index=_internal metrics kb group=per_sourcetype_thruput | eval sizeMB = round(kb/1024,2)| stats sum(sizeMB) by series | sort -sum(sizeMB) | rename sum(sizeMB) AS "Size on Disk (MB)"

Re: Is there a way to determine how much disk space my sourcetype is taking up?

TomSquare31 — Fri, 06 Jan 2017 17:18:53 GMT

Utilized your method @awurster and it worked perfectly. Thanks

Re: Is there a way to determine how much disk space my sourcetype is taking up?

chadmedeiros — Wed, 25 Jul 2018 04:19:45 GMT

I would be careful to convert to MB and round after sum'ing, not before