<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Does dbinspect output include cluster replication (RF) configuration? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Does-dbinspect-output-include-cluster-replication-RF/m-p/436716#M95059</link>
    <description>&lt;P&gt;@Beaker77&lt;/P&gt;

&lt;P&gt;Yes, sizeOnDiskMB will include the replication factor here. We should understand that RF means No. of copies of buckets that we have on the disk. Though these are not searchable copies and so might consume a little less space than searchable copies (which also includes tsidx files). But I guess the question is not ablout less or more space here.&lt;BR /&gt;
So the answer is yes, "sizeOnDiskMB" will include the replicated copies of data as well.&lt;/P&gt;

&lt;P&gt;Let me know if this answers you by marking this as answer and upvoting.&lt;BR /&gt;
Thanks&lt;/P&gt;</description>
    <pubDate>Fri, 21 Jun 2019 08:20:38 GMT</pubDate>
    <dc:creator>amitm05</dc:creator>
    <dc:date>2019-06-21T08:20:38Z</dc:date>
    <item>
      <title>Does dbinspect output include cluster replication (RF) configuration?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Does-dbinspect-output-include-cluster-replication-RF/m-p/436715#M95058</link>
      <description>&lt;P&gt;Oh Hai Splunkers!&lt;/P&gt;

&lt;P&gt;I've been trying to find out how much disk is being used and the associated compression ratio for a specific index. There's been some great examples using &lt;CODE&gt;dbinspect&lt;/CODE&gt; like the following:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| dbinspect index=myIndexName
| fields state,id,rawSize,sizeOnDiskMB 
| stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB
| eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
| eval compression=tostring(round(diskTotalinMB / rawTotalinMB * 100, 2)) + "%"
| table rawTotalinMB, diskTotalinMB, compression
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The output of this is what I'm after but I'm using a clustered environment, and am wondering if the &lt;CODE&gt;sizeOnDiskMB&lt;/CODE&gt; value includes the replication factor or not? &lt;/P&gt;

&lt;P&gt;For example, if I have an effective RF of 2, would I have to device the results of the above search by two to get the true size value of a single copy of the data?&lt;/P&gt;

&lt;P&gt;Thanks in advance!&lt;/P&gt;</description>
      <pubDate>Fri, 21 Jun 2019 00:06:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Does-dbinspect-output-include-cluster-replication-RF/m-p/436715#M95058</guid>
      <dc:creator>Beaker77</dc:creator>
      <dc:date>2019-06-21T00:06:46Z</dc:date>
    </item>
    <item>
      <title>Re: Does dbinspect output include cluster replication (RF) configuration?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Does-dbinspect-output-include-cluster-replication-RF/m-p/436716#M95059</link>
      <description>&lt;P&gt;@Beaker77&lt;/P&gt;

&lt;P&gt;Yes, sizeOnDiskMB will include the replication factor here. We should understand that RF means No. of copies of buckets that we have on the disk. Though these are not searchable copies and so might consume a little less space than searchable copies (which also includes tsidx files). But I guess the question is not ablout less or more space here.&lt;BR /&gt;
So the answer is yes, "sizeOnDiskMB" will include the replicated copies of data as well.&lt;/P&gt;

&lt;P&gt;Let me know if this answers you by marking this as answer and upvoting.&lt;BR /&gt;
Thanks&lt;/P&gt;</description>
      <pubDate>Fri, 21 Jun 2019 08:20:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Does-dbinspect-output-include-cluster-replication-RF/m-p/436716#M95059</guid>
      <dc:creator>amitm05</dc:creator>
      <dc:date>2019-06-21T08:20:38Z</dc:date>
    </item>
    <item>
      <title>Re: Does dbinspect output include cluster replication (RF) configuration?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Does-dbinspect-output-include-cluster-replication-RF/m-p/436717#M95060</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;Yes &lt;CODE&gt;dbinspect&lt;/CODE&gt; includes replication bucket as well. If you run below query and sort by &lt;CODE&gt;id&lt;/CODE&gt; , you will able to see same bucket id twice (if you have RF=2)&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| dbinspect index=qualys
| fields state,id,rawSize,sizeOnDiskMB,guId,bucketId,path
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 21 Jun 2019 08:23:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Does-dbinspect-output-include-cluster-replication-RF/m-p/436717#M95060</guid>
      <dc:creator>harsmarvania57</dc:creator>
      <dc:date>2019-06-21T08:23:26Z</dc:date>
    </item>
  </channel>
</rss>

