topic Re: How to calculate the index size from top 10 biggest indexers in Splunk Search

How to calculate the index size from top 10 biggest indexers

myleskennison — Sat, 16 Oct 2021 14:36:42 GMT

Sorry about this lame post. Our Splunk admin had to leave unexpectedly and now it's up to me to do this without any prior knowledge. I'm trying to figure out how to make a dashboard that displays our biggest indexers out of about 100. Management wants to know which indexes are ingesting the most data daily and how much.

Any help would be appreciated. Thank you

Re: How to calculate the index size from top 10 biggest indexers

richgalloway — Sat, 16 Oct 2021 15:05:08 GMT

Check the Monitoring Console. Settings->Monitoring console->Indexing->Indexes and Volumes:Instance.

Other dashboards in the MC may help, too.

Re: How to calculate the index size from top 10 biggest indexers

myleskennison — Sat, 16 Oct 2021 15:06:23 GMT

Thanks Rich but I don't have the monitoring console.

Re: How to calculate the index size from top 10 biggest indexers

richgalloway — Sat, 16 Oct 2021 16:36:19 GMT

Everyone has the monitoring console. It's built in to Splunk Enterprise. The trick may be in finding the right instance where the MC is configured.

A good resource for someone taking over a Splunk deployment is the Inherit a Splunk Deployment manual at https://docs.splunk.com/Documentation/Splunk/8.2.2/InheritedDeployment/Introduction

Re: How to calculate the index size from top 10 biggest indexers

scelikok — Sat, 16 Oct 2021 17:23:40 GMT

Hi @myleskennison,

In your question, there is confusion about indexes and indexers but I assume you need index sizes.

Please try below on your search head, it will show you total index sizes in megabytes and total event counts per index.

| rest /services/data/indexes | stats sum(currentDBSizeMB) as currentDBSizeMB sum(totalEventCount) as totalEventCount by title | rename title as index