https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39710#M7393 <P>setup for both internal and non-internal indexes.</P> Mon, 20 May 2013 18:54:43 GMT a212830 2013-05-20T18:54:43Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39701#M7384 <P>Hi,</P> <P>Is there a way to track disk usage per day for indexes? </P> Mon, 20 May 2013 12:51:57 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39701#M7384 a212830 2013-05-20T12:51:57Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39702#M7385 <P>Are you looking to say these files were modified, added, deleted? Or are you looking to say the hard drive has this much free space and alert me when it is at this level? What is the OS that you want all this on?</P> Mon, 20 May 2013 13:04:15 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39702#M7385 treinke 2013-05-20T13:04:15Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39703#M7386 <P>On Windows, Mark Russinovich who brought us sysinternals, has a 'du' utility. This needs to be downloaded...or: run the "diskuse" command <BR /> On UNIX, run: <BR /> du -h -s <YOUR> </YOUR></P> <P>Run both as a scripted output.</P> <P>You can have this command set to run every few hours or minutes and of course, Splunk the data. Once the data is in, you can create alerts.</P> Mon, 20 May 2013 13:23:17 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39703#M7386 barakreeves 2013-05-20T13:23:17Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39704#M7387 <P>So, a question on this - does license usage translate to disk storage use?</P> Mon, 20 May 2013 13:57:24 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39704#M7387 a212830 2013-05-20T13:57:24Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39705#M7388 <P>No, because indexes are compressed whereas license usage concerns the uncompressed amount of data.</P> Mon, 20 May 2013 14:03:37 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39705#M7388 Ayn 2013-05-20T14:03:37Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39706#M7389 <P>Thought so. Thanks. So, now that I know that, how can I get license usage for the past week for a specific license pool?</P> Mon, 20 May 2013 14:12:49 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39706#M7389 a212830 2013-05-20T14:12:49Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39707#M7390 <P>Try running this query: index=_internal type="Usage"<BR /> This query Splunks data from the license_usage.log file; one of the fields returned is "Pool" among other fields</P> Mon, 28 Sep 2020 13:56:27 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39707#M7390 barakreeves 2020-09-28T13:56:27Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39708#M7391 <P>Returns nothing.</P> Mon, 20 May 2013 17:29:01 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39708#M7391 a212830 2013-05-20T17:29:01Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39709#M7392 <P>How about going to Manager » Access controls » Roles » admin Indexes at the bottom and make sure Internal indexes are available; I have run into this before so it is the first thing I typically check. Let me know.</P> Mon, 20 May 2013 17:43:52 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39709#M7392 barakreeves 2013-05-20T17:43:52Z https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39710#M7393 <P>setup for both internal and non-internal indexes.</P> Mon, 20 May 2013 18:54:43 GMT https://community.splunk.com/t5/Getting-Data-In/disk-usage-for-indexer/m-p/39710#M7393 a212830 2013-05-20T18:54:43Z