topic Re: Charting Total Index Size vs Used Space Inside Index in Splunk Search

Charting Total Index Size vs Used Space Inside Index

aferone — Tue, 25 Sep 2012 19:59:59 GMT

Hello to all,

We have a few indexes that are configured with different max MB's. I want to be able to create a dashboard that shows pie charts of each index that shows total size of the index vs how much actual data is in each index.

I have no problems hard-coding the total values, but how do I get how many MB are being used in each index?

And for another elementary question, how I chart the total value vs the used value?

Thanks for the help!

Alex

Re: Charting Total Index Size vs Used Space Inside Index

melting — Tue, 25 Sep 2012 20:30:52 GMT

To get the index sizes you can use this search

 | eventcount summarize=false report_size=true index=* | eval MB = size_bytes / 1024 / 1024

To get the max index size, perhaps you could make a CSV and use it as a lookup: Here in the docs

Finally how to chart? Perhaps take a look at the Visualization the docs But to help start by making a table lik e this:

 ... | table index MB total_MB

Re: Charting Total Index Size vs Used Space Inside Index

paul_1994 — Wed, 16 Jan 2013 18:48:42 GMT

Updated Links for the links above

Here in the docs

Visualization the docs

The Visualization link may not be the same thing.. It seems the chart gallery is missing.

Re: Charting Total Index Size vs Used Space Inside Index

sdewar83 — Thu, 19 Sep 2019 03:39:14 GMT

This doesnt seem to work? I tried the eventcount command... what it shows in MB as the size of my indexes is less than what it shows when i navigate to the index folder on the server and less than what it shows in Settings > indexes. Settings > Indexes and the actual folder sizes on disk match up.