<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to find index size before splunk adding indexes...i mean raw data size in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351110#M64423</link>
    <description>&lt;P&gt;Look at the dbinspect command.&lt;/P&gt;

&lt;P&gt;&lt;A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect"&gt;https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect&lt;/A&gt;&lt;/P&gt;</description>
    <pubDate>Mon, 12 Jun 2017 22:16:16 GMT</pubDate>
    <dc:creator>somesoni2</dc:creator>
    <dc:date>2017-06-12T22:16:16Z</dc:date>
    <item>
      <title>How to find index size before splunk adding indexes...i mean raw data size</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351109#M64422</link>
      <description>&lt;P&gt;I have 10 indexes...i want to find the actual size of the index before splunk adding its indexing.&lt;/P&gt;

&lt;P&gt;and after as well.&lt;/P&gt;</description>
      <pubDate>Mon, 12 Jun 2017 18:13:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351109#M64422</guid>
      <dc:creator>jw44250</dc:creator>
      <dc:date>2017-06-12T18:13:52Z</dc:date>
    </item>
    <item>
      <title>Re: How to find index size before splunk adding indexes...i mean raw data size</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351110#M64423</link>
      <description>&lt;P&gt;Look at the dbinspect command.&lt;/P&gt;

&lt;P&gt;&lt;A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect"&gt;https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 12 Jun 2017 22:16:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351110#M64423</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2017-06-12T22:16:16Z</dc:date>
    </item>
    <item>
      <title>Re: How to find index size before splunk adding indexes...i mean raw data size</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351111#M64424</link>
      <description>&lt;P&gt;You need &lt;CODE&gt;dbinspect&lt;/CODE&gt; and the &lt;CODE&gt;rawSize&lt;/CODE&gt; field:&lt;BR /&gt;
&lt;A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect"&gt;https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;Try this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;|dbinspect index=a OR index=b OR ... OR index=z | table index rawSize
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;You might also check out the &lt;CODE&gt;Fire Brigade&lt;/CODE&gt; app:&lt;BR /&gt;
&lt;A href="https://splunkbase.splunk.com/app/1632/"&gt;https://splunkbase.splunk.com/app/1632/&lt;/A&gt;&lt;BR /&gt;
Or your &lt;CODE&gt;Monitoring Console&lt;/CODE&gt;:&lt;BR /&gt;
&lt;A href="https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/DMCoverview"&gt;https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/DMCoverview&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 12 Jun 2017 23:55:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351111#M64424</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2017-06-12T23:55:18Z</dc:date>
    </item>
    <item>
      <title>Re: How to find index size before splunk adding indexes...i mean raw data size</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351112#M64425</link>
      <description>&lt;P&gt;Thanks ..I think I should look do a course to become SPlunk Admin...&lt;/P&gt;

&lt;P&gt;From sample Query started (Just  write Query and that is the end...)---&amp;gt; dont know how far i will go into SPlunk &lt;/P&gt;</description>
      <pubDate>Fri, 16 Jun 2017 00:56:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351112#M64425</guid>
      <dc:creator>jw44250</dc:creator>
      <dc:date>2017-06-16T00:56:48Z</dc:date>
    </item>
    <item>
      <title>Re: How to find index size before splunk adding indexes...i mean raw data size</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351113#M64426</link>
      <description>&lt;P&gt;thanks -- sorry been busy with wrk&lt;/P&gt;</description>
      <pubDate>Fri, 16 Jun 2017 00:57:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-find-index-size-before-splunk-adding-indexes-i-mean-raw/m-p/351113#M64426</guid>
      <dc:creator>jw44250</dc:creator>
      <dc:date>2017-06-16T00:57:15Z</dc:date>
    </item>
  </channel>
</rss>

