https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413242#M6003 <P>yes exactly both</P> Tue, 11 Jun 2019 20:07:53 GMT splunkuseradmin 2019-06-11T20:07:53Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413239#M6000 <P>Hey all,<BR /> was wondering if there is way to find out usage of perticular index I have a query which gives some numbers i belive it is in kb's so i devided with 1048576 to get in GB's.<BR /> but is there any other ways to get more accurate data or some other ways so we can keep eyes on index=test usage data by user or by day something like that.</P> <PRE><CODE>index=test | eval length = length(_raw)/ 1048576 | timechart span=1d sum(length) as Length </CODE></PRE> <P>I have also been trying with below query but there is no data I get.</P> <PRE><CODE>index=test source=*license_usage.log* type=Usage </CODE></PRE> <P>thanks</P> Tue, 11 Jun 2019 19:44:29 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413239#M6000 splunkuseradmin 2019-06-11T19:44:29Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413240#M6001 <P>Are you trying to find out how much data is written to index=test or how often 'index=test' is used in a search query?</P> Tue, 11 Jun 2019 19:58:17 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413240#M6001 richgalloway 2019-06-11T19:58:17Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413241#M6002 <P>You can navigate to the Monitoring Console and view indexes with amount of data over time. It uses "index=_internal source=license_usage.log type=Usage" by default.</P> <P>If you're searching "index=test source=license_usage.log type=Usage" then you will not be able to find license_usage.log because they are in index=_internal.</P> Wed, 30 Sep 2020 00:53:07 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413241#M6002 jazzypai 2020-09-30T00:53:07Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413242#M6003 <P>yes exactly both</P> Tue, 11 Jun 2019 20:07:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413242#M6003 splunkuseradmin 2019-06-11T20:07:53Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413243#M6004 <P>I was looking to find out details for index=test</P> <BLOCKQUOTE> <P>how much data is written on index ?<BR /> how often index=test is used in search queries?</P> </BLOCKQUOTE> Tue, 11 Jun 2019 20:10:46 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413243#M6004 splunkuseradmin 2019-06-11T20:10:46Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413244#M6005 <P>any suggestions</P> Wed, 12 Jun 2019 18:15:37 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413244#M6005 splunkuseradmin 2019-06-12T18:15:37Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413245#M6006 <P>any suggestions</P> Wed, 12 Jun 2019 18:31:45 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413245#M6006 splunkuseradmin 2019-06-12T18:31:45Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413246#M6007 <P>For how much data is written on index, you could view it through the gui by going to Settings &gt; Indexes and viewing the summary of the index. If you need more granular let me know but I don't have access to verify searches right now.</P> <P>This link provides a search which uses the _audit index to view what users are doing. Again, I can't verify right now but if you follow the advice you should be able to get retrieve all the events which include search queries. You would then need to search for "index=test" within those results and do a stats count. Please take a look and report back.</P> <P><A href="https://answers.splunk.com/answers/149332/how-to-view-the-list-of-search-queries-run-for-a-given-time.html">https://answers.splunk.com/answers/149332/how-to-view-the-list-of-search-queries-run-for-a-given-time.html</A></P> Wed, 12 Jun 2019 19:07:25 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413246#M6007 jazzypai 2019-06-12T19:07:25Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413247#M6008 <P>I wanted to see how usage looks like. <BR /> ex.. if we doing 30% of data in index or calculation of all events and space using or may be how it runs month to date and shows usage looks like.</P> Wed, 12 Jun 2019 20:19:19 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413247#M6008 splunkuseradmin 2019-06-12T20:19:19Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413248#M6009 <P>i have poweruser roles not the admin roles and if i try doing search with index=test</P> <P>"index=test action=search" nuthing shows up it looks like no action field available for every index ??</P> Wed, 12 Jun 2019 20:21:03 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-get-usage-of-a-particular-index-or-query-usage/m-p/413248#M6009 splunkuseradmin 2019-06-12T20:21:03Z