topic max index size value in Splunk Search

max index size value

EricPartington — Thu, 09 Jun 2011 16:20:41 GMT

How do I search for and return the max index size as defined by the indexes.conf file?

I want to get the same value that you can see from the Manager > indexes page (Max size (MB) of entire index )

metadata or dbinspect?

Re: max index size value

cgilbert_splunk — Thu, 09 Jun 2011 22:17:35 GMT

Okay, I'll give it a shot...I didn't see any way of doing this with either metadata or dbinspect...but here's what I did:

1) I splunked Splunk...basically, I started monitoring my /splunk/etc directory and ingesting all my splunk config files
2) I determined that the parameter I was looking for in the indexes.conf file is: maxTotalDataSizeMB
3) I defined a field extraction to extract the "header" of each section of a splunk conf file...my regex is: (?im)^(?P

[.+]$) ...this helps when I perform my search
4) The search I used after doing all this was:

source="/splunk/etc/system/local/indexes.conf" | table Header maxTotalDataSizeMB | rename Header to Index

Index maxTotalDataSizeMB

[_thefishbucket] 600000

(this is what the results looked like...well, it looked better in Splunk, but hopefully you get the picture)...by the way, this matched up exactly to what I saw in manager.

Not at all sure if this solves your problem the way you wanted it solved, but I had fun trying to figure it out!

Re: max index size value

EricPartington — Sat, 18 Jun 2011 22:08:35 GMT

I'll give this a shot, although I have a distributed environment and am using deployment server so i'll be looking to injest each indexes.conf file from each app.
should be interesting to see if this works.

thanks for the suggestion.