topic Re: Run dbinspect as a scheduled job and make the result available to your SH in Splunk Search

Run dbinspect as a scheduled job and make the result available to your SH

the_wolverine — Mon, 17 Feb 2014 05:15:08 GMT

dbinspect has to be run on the indexer. It can't be run from the search head. How do I get the result from my search head?

Re: Run dbinspect as a scheduled job and make the result available to your SH

the_wolverine — Mon, 17 Feb 2014 05:15:27 GMT

Schedule the following search to run on your indexer:

   | dbinspect index=index_name 
    | rex field=path "^/path_to_index/(?P<index>\w+_\w+[^/]+)"
    | fields state,id,rawSize,sizeOnDiskMB,index
    | stats sum(rawSize) AS rawTotal, sum(sizeOnDiskMB) AS diskTotalinMB by index
    | eval rawTotalinMB=(rawTotal / 1024 / 1024) | fields - rawTotal
    | eval compression_factor=tostring(round((rawTotalinMB-diskTotalinMB) / rawTotalinMB , 2)) 
    | table index,rawTotalinMB, diskTotalinMB, compression_factor 
    | summaryindex spool=t addtime=t index=summary

The summaryindex command writes the result to your summary index where you can fetch it from your SH.

I haven't figured out how to get a single search to do this for all my indexes. For now I set up a search for each index.

Re: Run dbinspect as a scheduled job and make the result available to your SH

dshpritz — Mon, 17 Feb 2014 06:27:31 GMT

Have you looked at Fire Brigade? The TA includes inputs for dbinspect. You get a lot of information about your indexing and buckets from the app, and I highly recommend it. If you don't want the whole app, you could always pull apart the inputs.

HTH,

Dave