https://community.splunk.com/t5/Reporting/How-to-determine-what-is-filling-up-your-index-space/m-p/137855#M3089 <P>Hi,</P> <P>I have an index(es) that are beginning to rapidly fill up my filesystems on a cluster. What is the quickest way to determine who the culprits are?</P> Sat, 25 Jul 2015 02:18:46 GMT a212830 2015-07-25T02:18:46Z https://community.splunk.com/t5/Reporting/How-to-determine-what-is-filling-up-your-index-space/m-p/137855#M3089 <P>Hi,</P> <P>I have an index(es) that are beginning to rapidly fill up my filesystems on a cluster. What is the quickest way to determine who the culprits are?</P> Sat, 25 Jul 2015 02:18:46 GMT https://community.splunk.com/t5/Reporting/How-to-determine-what-is-filling-up-your-index-space/m-p/137855#M3089 a212830 2015-07-25T02:18:46Z https://community.splunk.com/t5/Reporting/How-to-determine-what-is-filling-up-your-index-space/m-p/137856#M3090 <P>You can use firebrigade or <CODE>dbinspect</CODE> to see what indexes take up how much space in which buckets, and what your compression ratio is. You can use SoS or the new Distributed Management Console or the Licensing views to see what hosts, sourcetypes, etc. make up the most incoming data. Additionally, take cluster search and replication factors into account.</P> Sat, 25 Jul 2015 11:43:35 GMT https://community.splunk.com/t5/Reporting/How-to-determine-what-is-filling-up-your-index-space/m-p/137856#M3090 martin_mueller 2015-07-25T11:43:35Z