topic Re: How to calculate the index size from all indexers in Splunk Search

How to calculate the index size from all indexers

adityapavan18 — Mon, 14 Oct 2013 10:21:46 GMT

Is there a way to calculate total size of an index from all indexers?
I can see index size from each individual indexer but i have around 30 indexers in the setup i am working on..so ideally wouldn't work if go and check index size in each indexer individually

Re: How to calculate the index size from all indexers

MuS — Mon, 14 Oct 2013 10:50:43 GMT

Hi adityapavan18

one way would be to use the REST endpoint /services/data/indexes for that, but this must be done against each indexer. Personally I would setup a summarized saved search on each indexer which runs the following search:

     | rest /services/data/indexes | stats values(currentDBSizeMB) by title

This way you will be able to get the index size for each indexer with one single search afterwards.

hope this helps ...

cheers, MuS

Re: How to calculate the index size from all indexers

MHibbin — Mon, 14 Oct 2013 10:59:32 GMT

The eventcount command may be what you need:

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Eventcount

Haven't tried it against multiple indexers however.

This command requires a "|" before the command to run.

Hope this helps.

Re: How to calculate the index size from all indexers

alacercogitatus — Mon, 14 Oct 2013 11:49:52 GMT

Building on MuS' answer, you can do each indexer from a single search head. This will require SoS to be installed ( http://apps.splunk.com/app/748/ ).

Each of these calls should be really quick, so the number of search-peers will increase execution time, but not as badly as if you were doing a data search.

You can also adjust the stats do whatever you need, | stats sum(currentDBSizeMB) by title.

Re: How to calculate the index size from all indexers

adityapavan18 — Mon, 14 Oct 2013 12:23:02 GMT

Thanx a lot...I do have S.o.S installed..and running this query provided me the data i require

Re: How to calculate the index size from all indexers

alacercogitatus — Mon, 14 Oct 2013 12:23:57 GMT

You can even summarize this (with |collect index=summary) and then do data capacity planning!

Re: How to calculate the index size from all indexers

adityapavan18 — Mon, 14 Oct 2013 12:24:03 GMT

Thanx MuS.

Re: How to calculate the index size from all indexers

adityapavan18 — Mon, 14 Oct 2013 12:24:46 GMT

this helps only for a particular indexer.Not sure how we use for multiple indexers

Re: How to calculate the index size from all indexers

MHibbin — Mon, 14 Oct 2013 14:32:41 GMT

@adityapavan18, again I'm not sure, as I only one indexer to play around with at the moment, but perhaps the following, seems odd to me that it has the server field if it is localized to one server...

| eventcount summarize=false index=* report_size=true | eval MB=(size_bytes/1024)/1024 | stats sum(MB) by index, server

Re: How to calculate the index size from all indexers

awurster — Mon, 09 Feb 2015 01:39:50 GMT

this is way better, as anything that requires the 3rd party app like SOS is not a clean one IMHO. i think more and more of these weird little tasks must be phased out and worked into core splunk (via REST API for instance or DMC moving forward.

Re: How to calculate the index size from all indexers

mendesjo — Mon, 22 Feb 2016 14:05:51 GMT

| rest /services/data/indexes | stats values(currentDBSizeMB) by title

That only provides data of index per indexer, it's not added up.. How would you sum it?

Re: How to calculate the index size from all indexers

mendesjo — Mon, 22 Feb 2016 14:06:26 GMT

Nope doesn't work..

Re: How to calculate the index size from all indexers

Muryoutaisuu — Thu, 30 Jun 2016 06:35:16 GMT

why not just use | stats sum(currentDBSizeMB) by title

instead of values?

Re: How to calculate the index size from all indexers

MuS — Tue, 17 Oct 2017 22:18:58 GMT

Because currentDBSizeMB is the size of each index and there is no need to sum() them.

Re: How to calculate the index size from all indexers

MuS — Tue, 17 Oct 2017 22:22:29 GMT

Quick and dirty solution is to run this:

 | rest /services/data/indexes | where totalEventCount!=0 | stats values(currentDBSizeMB) AS size by title | streamstats sum(size) AS total

Re: How to calculate the index size from all indexers

sowings — Tue, 17 Oct 2017 23:38:31 GMT

Note that currentDBsizeMB is 1 for an index with no events. Might want to filter out those where totalEventCount=0

Re: How to calculate the index size from all indexers

MuS — Wed, 18 Oct 2017 02:12:05 GMT

Good point, I changed the search - thanks 😉

Re: How to calculate the index size from all indexers

dtrelford — Mon, 22 Oct 2018 18:18:08 GMT

SoS is discontinued and no longer supported. Is there an alternative query that can be run now?

My apologies if I should have posted this in a new question.

Re: How to calculate the index size from all indexers

gjanders — Mon, 22 Oct 2018 21:48:07 GMT

| rest /services/data/indexes |  stats sum(currentDBSizeMB) by title splunk_server

The above might do it, you can use the REST API or use the monitoring console. The monitoring console has a variety of queries that do this which you can borrow by clicking on the magnifying glass (it replaces SoS)

Re: How to calculate the index size from all indexers

aokur_splunk — Fri, 08 Feb 2019 16:35:07 GMT

worked for me - thanks MHibbin