topic Re: HOW TO CALCULATE LOG SAVE ON INDEXER in Monitoring Splunk

HOW TO CALCULATE LOG SAVE ON INDEXER

jacknguyen — Tue, 02 Jul 2024 08:00:25 GMT

Hi guys,

My boss check on Splunk Master and see that, he want to know index, source, sourcetype, capacity of log/day for each sourcetype, How can I see that

I used this search before, but I feel its not corect 100%,

| dbinspect index=* | stats sum(rawSize) as total_size by index | eval total_size_mb = total_size / (1024 * 1024) | table index total_size_mb

How I can check this on my Indexer, I can ssh to Indexer too.
Thank you for your time

Re: HOW TO CALCULATE LOG SAVE ON INDEXER

gcusello — Tue, 02 Jul 2024 08:09:13 GMT

Hi @jacknguyen ,

if you use the Monitoring Console or the License consuption dashboard, you can have these information.

Ciao.

Giuseppe

Re: HOW TO CALCULATE LOG SAVE ON INDEXER

jacknguyen — Tue, 02 Jul 2024 08:15:28 GMT

I cannot access the License Master, I also check Monitoring console in Index volume and instance, no result founds.

Re: HOW TO CALCULATE LOG SAVE ON INDEXER

gcusello — Tue, 02 Jul 2024 08:44:45 GMT

Hi @jacknguyen,

in the monitoring Console at [Indexing > License Usage > Historic License usage ] you can display the license usage split by index or sourcetype, etc...

If this doesn't exactly answer to your question, you can start from this search to customize your own.

Ciao.

Giuseppe

Re: HOW TO CALCULATE LOG SAVE ON INDEXER

jacknguyen — Tue, 02 Jul 2024 08:48:39 GMT

I cannot see anything. Do you know the search can check this?

Re: HOW TO CALCULATE LOG SAVE ON INDEXER

gcusello — Tue, 02 Jul 2024 08:51:20 GMT

Hi @jacknguyen,

this isn't the dashboard I indicated, becsuase you need the historic license consuption not the daily one, anyway, you have a configuration issue on your Monitoring Console, I hint to open a case to Splunk Support for this, otherwise, you cannot solve your request.

Ciao.

Giuseppe

Re: HOW TO CALCULATE LOG SAVE ON INDEXER

jacknguyen — Tue, 02 Jul 2024 09:26:28 GMT

I use this search

| dbinspect index=* | stats sum(rawSize) as total_size by index | eval total_size_mb = total_size / (1024 * 1024) | table index total_size_mb

and get this result is this right?

Re: HOW TO CALCULATE LOG SAVE ON INDEXER

gcusello — Tue, 02 Jul 2024 12:28:34 GMT

Hi @jacknguyen,

yes, it should be right, what's the problem?

Ciao.

Giuseppe

Re: HOW TO CALCULATE LOG SAVE ON INDEXER

gcusello — Wed, 03 Jul 2024 05:43:58 GMT

Hi @jacknguyen ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉