https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-run-dbinspect-from-cli-for-calculating/m-p/111874#M183696 <P>It worked! Thanks.</P> Wed, 23 Oct 2013 23:49:40 GMT the_wolverine 2013-10-23T23:49:40Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-run-dbinspect-from-cli-for-calculating/m-p/111872#M183694 <P>I'd like to run the following search on my indexer to calculate compression. It works in UI, but not in CLI. I have disabled splunkweb on my indexers (as we use a separate search head pool) so I'd like to be able to run it from CLI:</P> <PRE><CODE>| dbinspect index=_internal | fields state,id,rawSize,sizeOnDiskMB | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal | eval compression=tostring(round(diskTotalinMB / rawTotalinMB * 100, 2)) + "%" | table rawTotalinMB, diskTotalinMB, compression </CODE></PRE> Wed, 23 Oct 2013 17:06:29 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-run-dbinspect-from-cli-for-calculating/m-p/111872#M183694 the_wolverine 2013-10-23T17:06:29Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-run-dbinspect-from-cli-for-calculating/m-p/111873#M183695 <P>This is the exact syntax I used from the command line:</P> <PRE> /opt/splunk/bin/splunk search '| dbinspect index=_internal | fields state,id,rawSize,sizeOnDiskMB | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal | eval compression=tostring(round(diskTotalinMB / rawTotalinMB * 100, 2)) + "%" | table rawTotalinMB, diskTotalinMB, compression' -preview f </PRE> Wed, 23 Oct 2013 20:10:34 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-run-dbinspect-from-cli-for-calculating/m-p/111873#M183695 sowings 2013-10-23T20:10:34Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-run-dbinspect-from-cli-for-calculating/m-p/111874#M183696 <P>It worked! Thanks.</P> Wed, 23 Oct 2013 23:49:40 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-unable-to-run-dbinspect-from-cli-for-calculating/m-p/111874#M183696 the_wolverine 2013-10-23T23:49:40Z