topic Re: Daily log usage in Installation

Daily log usage

jwjorgensen — Mon, 15 Jun 2020 19:41:43 GMT

Hello,

Can anyone tell me where I would go to find daily log storage info? I am trying to get an average of how much storage per day is currently being used, so I can figure out what license I would need to purchase.

Any info is much appreciated!

Jesse Jorgensen

Re: Daily log usage

sdaniels — Mon, 28 Sep 2020 11:49:34 GMT

This search will show you the amount of data for your indexes for 1 day.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0

Also in the UI you can go to the Search App -> Status (menu) -> Index Activity -> Indexing Volume. The Splunk on Splunk App also provides all of the details in addition to the health of your environment.

http:///en-US/app/search/indexing_volume

Re: Daily log usage

jwjorgensen — Tue, 15 May 2012 20:16:35 GMT

That's just what I needed. Thanks for your help!

Re: Daily log usage

edriggers — Tue, 29 Sep 2020 20:47:21 GMT

The search above got me started in the right direction. I find this outputs the data in a more elegant format:

index=_internal source=*license_usage.log
earliest=-24h
| eval GB=round(b/1024/1024/1024, 2)
| stats sum(GB) count by st
| sort - sum(GB)