topic Re: Splunk Ingestion Metrics in Splunk Search

Splunk Ingestion Metrics

scout29 — Mon, 01 Jul 2024 16:02:21 GMT

I am trying to get the ingestion per day in Terabytes for each index. I am using the below search which works, however the ingestion numbers are not formatted great. For example, using the below search, for an index i get a usage value of 4587.16 which would be 4.59 terabytes per day. I am looking for this number to be rounded in the search results to show like 4.59

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=* | stats sum(b) as usage by idx | rename idx as index | eval usage=round(usage/1024/1024/1024,2)

Re: Splunk Ingestion Metrics

richgalloway — Mon, 01 Jul 2024 15:43:11 GMT

That query works for me. What results do you get and how do they not match what you want?

Re: Splunk Ingestion Metrics

scout29 — Mon, 01 Jul 2024 16:20:59 GMT

Yes, the query works - however i want the values to be formatted differently within the search results. I would like the values to show in terabytes. For example, using the query i get a value of 4587.43 (in GB) for an index ingestion value. I would like this to round and show in Terabytes as 4.59

Re: Splunk Ingestion Metrics

richgalloway — Mon, 01 Jul 2024 16:35:14 GMT

The eval command is converting bytes into gigabytes. Add another `/1024` to convert to terabytes.

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=* | stats sum(b) as usage by idx | rename idx as index | eval usage=round(usage/1024/1024/1024/1024,2)