https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165816#M33631 <P>Thank you, there is such index.<BR /> Is there a way to aggregate it by day? It shows data for each 30 sec.<BR /> Although aggregation like avg is not required, just looking to get any size value per index per day.</P> Thu, 16 Oct 2014 20:58:28 GMT rnr 2014-10-16T20:58:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165814#M33629 <P>Hi Splunk experts,</P> <P>Here is a search request:</P> <P>| eventcount summarize=false report_size=true index=* | eval GB = size_bytes / 1024 / 1024 / 1024 | eval GB = round(GB, 0) | sort GB | reverse | head 10</P> <P>How can I get these size counters for splunk indexes over period of time, say daily? <BR /> I'd like to check how fast vol utilization by indexes is growing over time.</P> Mon, 28 Sep 2020 17:54:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165814#M33629 rnr 2020-09-28T17:54:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165815#M33630 <P>Just let Splunk do the heavy lifting.</P> <PRE><CODE>index=_introspection component=Indexes | timechart avg("data.total_size") by data.name </CODE></PRE> <P>I believe the introspection index was added in 6.1... so if you're stuck on a lower version you could have your search run daily and summary index the results, then run your report on that summary index.</P> Thu, 16 Oct 2014 20:21:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165815#M33630 martin_mueller 2014-10-16T20:21:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165816#M33631 <P>Thank you, there is such index.<BR /> Is there a way to aggregate it by day? It shows data for each 30 sec.<BR /> Although aggregation like avg is not required, just looking to get any size value per index per day.</P> Thu, 16 Oct 2014 20:58:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165816#M33631 rnr 2014-10-16T20:58:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165817#M33632 <P>Right, <CODE>avg()</CODE> may not be what you're looking for. Consider this:</P> <PRE><CODE> index=_introspection component=Indexes | timechart span=1d max("data.total_size") by data.name </CODE></PRE> <P>That takes exactly one value per index per day, the highest value to be precise.</P> Thu, 16 Oct 2014 21:06:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165817#M33632 martin_mueller 2014-10-16T21:06:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165818#M33633 <P>Ok, that did the trick!</P> <P>And last question, if I want to have data.total_size in GB - how to apply "eval"?</P> Thu, 16 Oct 2014 21:23:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165818#M33633 rnr 2014-10-16T21:23:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165819#M33634 <P>Easy as pie:</P> <PRE><CODE> index=_introspection component=Indexes | eval data.total_size = 'data.total_size' / 1024 | timechart span=1d max("data.total_size") by data.name </CODE></PRE> <P>Note the use of single quotation marks on the RHS of the <CODE>eval</CODE> to avoid interpreting the dot as the concatenation operator.</P> Thu, 16 Oct 2014 21:26:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165819#M33634 martin_mueller 2014-10-16T21:26:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165820#M33635 <P>All worked, thank you. </P> Fri, 17 Oct 2014 14:26:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165820#M33635 rnr 2014-10-17T14:26:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165821#M33636 <P>Running this query, seems to give me what the typical size of a particular index on a single indexer, supposed you have many indexers? Why isn't this adding up and giving a full index size accross all your indexers? How do you add it all up to give you the illusive report that many people have been looking for which is, index size over time. Finally, this seems to give you 10 indexes only.</P> Tue, 02 May 2017 22:40:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165821#M33636 mendesjo 2017-05-02T22:40:02Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165822#M33637 <P>By now, using the monitoring console in recent versions of splunk should give you that info across all boxes.</P> Fri, 19 May 2017 09:18:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-size-counters-for-Splunk-indexes-over-a-period-of/m-p/165822#M33637 martin_mueller 2017-05-19T09:18:48Z