https://community.splunk.com/t5/Splunk-Search/REST-Splunk-job/m-p/697489#M236937 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;thanks for your response.&nbsp;<BR /><BR />So my requirement is to show disk usage of every user for their searches.&nbsp; I tried with audit index but there I can see search name and it's count.&nbsp;<BR /><BR />I want to show the historical data of disk usage for each user.&nbsp;<BR /><BR /></P> Tue, 27 Aug 2024 16:03:42 GMT bharat 2024-08-27T16:03:42Z https://community.splunk.com/t5/Splunk-Search/REST-Splunk-job/m-p/697353#M236907 <P>Hi Splunkers,<BR /><BR />I'm trying to get diskusage for searches running by user.</P> <LI-CODE lang="markup">| rest /services/search/jobs | rex field=eventSearch "index\s*=(?&lt;index&gt;[^,\s)]+)" | search index=$ind$ | eval size_MB = diskUsage/1024/1024 | stats sum(size_MB) as size_MB by author | rename author as user</LI-CODE> <P>Is there a way to get diskusage for historical log's like for a month or more. ?</P> Mon, 26 Aug 2024 20:57:22 GMT https://community.splunk.com/t5/Splunk-Search/REST-Splunk-job/m-p/697353#M236907 bharat 2024-08-26T20:57:22Z https://community.splunk.com/t5/Splunk-Search/REST-Splunk-job/m-p/697457#M236927 <P>Splunk REST commands return information about the current state of the service.&nbsp; They are not historical.</P><P>Disk space used by search jobs is ephemeral.&nbsp; Once the job expires (usually in 10 minutes), the disk space is released so a monthly total of disk usage is pretty meaningless.</P><P>What problem are you trying to solve?</P> Tue, 27 Aug 2024 12:24:40 GMT https://community.splunk.com/t5/Splunk-Search/REST-Splunk-job/m-p/697457#M236927 richgalloway 2024-08-27T12:24:40Z https://community.splunk.com/t5/Splunk-Search/REST-Splunk-job/m-p/697489#M236937 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;thanks for your response.&nbsp;<BR /><BR />So my requirement is to show disk usage of every user for their searches.&nbsp; I tried with audit index but there I can see search name and it's count.&nbsp;<BR /><BR />I want to show the historical data of disk usage for each user.&nbsp;<BR /><BR /></P> Tue, 27 Aug 2024 16:03:42 GMT https://community.splunk.com/t5/Splunk-Search/REST-Splunk-job/m-p/697489#M236937 bharat 2024-08-27T16:03:42Z https://community.splunk.com/t5/Splunk-Search/REST-Splunk-job/m-p/697497#M236939 <P>IIRC, the _introspection index has disk space usage data for searches.&nbsp; I still question the utility of that information, however, since the usage is not cumulative.</P> Tue, 27 Aug 2024 16:54:00 GMT https://community.splunk.com/t5/Splunk-Search/REST-Splunk-job/m-p/697497#M236939 richgalloway 2024-08-27T16:54:00Z