topic Re: Can you use tstats to get daily index or indexer volume? in Splunk Search

Can you use tstats to get daily index or indexer volume?

Glasses — Wed, 30 Sep 2020 05:29:07 GMT

Just wondering if its possible to get data volume / size from TSTATS.

I know you can do something like this to get counts (events/per sec)

| tstats count WHERE index=* by index| eval events_per_second=count/(3600*24)

but how can you use tstats for find volume of data per time?

Re: Can you use tstats to get daily index or indexer volume?

richgalloway — Thu, 21 May 2020 12:36:11 GMT

As far as I can tell, there is no indexed field that indicates data volume so you can't use tstats to get that value.

Re: Can you use tstats to get daily index or indexer volume?

Glasses — Thu, 21 May 2020 13:13:37 GMT

thank you for confirming, I could not find a list of tstats fields.... is there a doc for tstat fields?

Re: Can you use tstats to get daily index or indexer volume?

richgalloway — Fri, 22 May 2020 12:43:02 GMT

There is no documentation for tstats fields because the list of fields is not fixed. It depends on which fields you choose to extract at index time. You can, however, use the walklex command to find such a list.

walklex type=term index=foo