topic Re: What is the exact Splunk DB path in Email Security Appliance? in Getting Data In

What is the exact Splunk DB path in Email Security Appliance?

dhsetty — Fri, 24 Feb 2017 12:01:02 GMT

Hello All,

Currently we are using Splunk with Email Security Appliance.
All I know is the command ---> du -sk /data/db/splunk , to know the space consumed by Splunk DB.

But could you please help me with the path of Splunk, where Message Tracking, Reporting data is stored in Email Security Appliance.

Thanks & Regards,
Dharmendra Setty

Re: What is the exact Splunk DB path in Email Security Appliance?

lguinn2 — Fri, 24 Feb 2017 16:07:39 GMT

Cisco sells an email security appliance; this device produces log files of its activity. Splunk has an app that understands the logs from the Cisco ESA: Splunk Add-on for Cisco ESA The documentation for the Splunk Add-on for Cisco ESA is here

When you set up the Splunk inputs, you choose the index for the Cisco ESA data. And in indexes.conf on the indexer(s), you specify where disk space is allocated for the indexes.

You can use the Splunk Monitoring Console to see how much disk space is used by each index. But you will have to look at your configuration to determine where the Cisco ESA data is stored.

Re: What is the exact Splunk DB path in Email Security Appliance?

dhsetty — Mon, 27 Feb 2017 04:48:30 GMT

Hi Iguinn[Splunk],

How to use the Splunk Monitoring Console, to see the disk space usage by each index.

Can you please share me the steps on usage of Splunk Monitoring Console.

Thanks & Regards,
Dharmendra Setty

Re: What is the exact Splunk DB path in Email Security Appliance?

dhsetty — Tue, 29 Sep 2020 12:59:30 GMT

Also my requirement is:

Suppose I make a Splunk DB Query as below:
a=1
b=1000

search_parms = {'date_from': '1/10/2016:05:00', 'start': a, 'stop': b, 'timeout': 60, 'date_to': '02/22/2017:23:39', 'mask_prvs': 0, 'maxresults': 100000},

So, the Splunk response is bucketed output grouping based on MIDs.
a. How to delete these results from Splunk DB which are indexed?
b. How to find the Splunk DB storage space after deleted?

Thanks & Regards,
Dharmendra Setty