topic Re: Comparing index sizes on 2 dates in Splunk Search

Comparing index sizes on 2 dates

tsheets13 — Wed, 24 Jun 2020 18:31:35 GMT

I have been asked to create an alert that looks at the index sizes (all indexes) for today, and compare them to the sizes as they were one week ago. I know I can get the index sizes for the last 7 days with

 index=_introspection component=Indexes | eval data.total_size = 'data.total_size' / 1024 | timechart span=1d max("data.total_size") by data.name

However, how can I compare the sizes of each index, 1 by 1, between today and 7 days ago.

Thanks for the help.

Re: Comparing index sizes on 2 dates

manjunathmeti — Wed, 04 Mar 2020 19:46:02 GMT

Hi @tsheets13,

Try this:

index=_introspection component=Indexes earliest=-1d@d latest=@d 
| eval field="today" 
| append 
    [ search index=_introspection component=Indexes earliest=-8d@d latest=-7d@d 
    | eval field="sevendaysago"] 
| eval total_size = 'data.total_size'/1024 
| stats max(total_size) as total_size by data.name, field 
| xyseries data.name field total_size 
| where today > sevendaysago

Re: Comparing index sizes on 2 dates

tsheets13 — Wed, 04 Mar 2020 20:33:22 GMT

That's perfect. I am not sure why you singled out indexes with the name of device and syslogs, but after I removed that, I got what I want. Now if you don't mind helping me take it just a step further. I need to alert if the difference between today and sevendaysago are greater than 20% on any given index and report that index and difference. Thanks

Re: Comparing index sizes on 2 dates

manjunathmeti — Wed, 04 Mar 2020 23:58:50 GMT

I was checking this query on test data on my machine. You can calculate difference and check if it is greater than 20% of index size 7 days ago. Check this.

index=_introspection component=Indexes earliest=-1d@d latest=@d 
| eval field="today" 
| append 
    [ search index=_introspection component=Indexes earliest=-8d@d latest=-7d@d 
    | eval field="sevendaysago"] 
| eval total_size = 'data.total_size'/1024 
| stats max(total_size) as total_size by data.name, field 
| xyseries data.name field total_size 
| eval difference = today - sevendaysago 
| where difference > sevendaysago*20/100

Please accept and upvote answer if this helps you:)

Re: Comparing index sizes on 2 dates

tsheets13 — Thu, 05 Mar 2020 14:14:35 GMT

exactly what I needed, thank you!

Re: Comparing index sizes on 2 dates

manjunathmeti — Fri, 06 Mar 2020 08:16:34 GMT

you're welcome.