topic Re: event number from _internal index in Monitoring Splunk

event number from _internal index

Splunk_U — Mon, 28 Jan 2013 14:24:26 GMT

I need to know the number of event by the index os from the _internal index

Re: event number from _internal index

kristian_kolb — Mon, 28 Jan 2013 14:53:04 GMT

Manager -> indexes will show the number of events per index. If this is not what you want, try to rephrase your question.

Re: event number from _internal index

Splunk_U — Mon, 28 Jan 2013 14:56:03 GMT

I want to build a search query on _internal index that will tell me the number of events per every other indexes (like os, custom index) present on the server.

Re: event number from _internal index

kristian_kolb — Mon, 28 Jan 2013 15:08:00 GMT

I don't think that information is present in _internal, at least not the exact number of events. You could probably find some approximation by looking at the metrics logs (in _internal). The search below will tell you the daily amount of events per index (non-internal indexes only).

index=_internal sourcetype=splunkd component=Metrics group=per_index_thruput series!=_* | timechart span=1d sum(ev) by series

Hope this helps,

Re: event number from _internal index

Splunk_U — Mon, 28 Sep 2020 13:11:49 GMT

I have modified the query as I need the internal index data also..

index=_internal sourcetype=splunkd component=Metrics group=per_index_thruput series=* | stats sum(ev) by series, host

Now I have made all the data from the UF, Search Head to go to a particular Indexer. So the above query is giving the data for that Indexer only. Can I distinctly that from which original host the data is comming. I tried to use sourceHost but its not working

Re: event number from _internal index

yannK — Tue, 29 Jan 2013 07:53:31 GMT

I would not trust the metrics for any type of calculation of volume, for the simple reason that metrics.log measure only the top 10 sample.

If you really want to know the current number of events in a particular index , use the | dbinspect index=myindex command on your indexers.