topic Re: Pass dbinspect result to calculate index disk space in Monitoring Splunk

Pass dbinspect result to calculate index disk space

shan_santosh — Thu, 14 Apr 2016 12:33:44 GMT

I this search below to calculate compression rate of my index

| dbinspect index=myIndexName
| stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB
| eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
| eval compression=round(diskTotalinMB / rawTotalinMB * 100, 2)
| table compression

Then I want to further use the compression value in below search in place of constant value .4

index=_internal source=*metrics.log group=per_index_thruput series=myIndexName | eval MB = round
(kb/1024,2) * .4 | reverse | accum MB as totalvalue | timechart last(totalvalue) span=1d

I tried subsearch and join, but no success. Can any one suggest a solution, hint?

Re: Pass dbinspect result to calculate index disk space

martin_mueller — Thu, 14 Apr 2016 22:30:25 GMT

Here's a generic example of how to pass a subsearch result into an eval:

| stats count | eval foo = exact(42 * [stats count as search | eval search = 0.1])

This should be translatable to your case, make sure to use the special field search to avoid quotes being added.

Re: Pass dbinspect result to calculate index disk space

shan_santosh — Fri, 15 Apr 2016 05:18:49 GMT

Thanks for your reply. however in my case I want to use dbinspect and use its output for sub search. dbinspect has to be a first statement in the search which I can not use as a subsearch. Some sample wrt my scenario will be of great help.

Re: Pass dbinspect result to calculate index disk space

martin_mueller — Fri, 15 Apr 2016 13:12:58 GMT

Works the same way, it's the first command of the subsearch:

| stats count | eval foo = exact(42 * [dbinspect index=main
  | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB
  | eval search=diskTotalinMB / rawTotal * 1024 * 1024 | fields search])

Re: Pass dbinspect result to calculate index disk space

shan_santosh — Mon, 18 Apr 2016 06:18:06 GMT

This worked for me. Thanks for your help.