topic Details on indexes in Splunk Search

Details on indexes

beepboop12 — Fri, 16 Jan 2015 21:39:27 GMT

Hello, I need certain details for my indexes. I have searched Splunk answers but have yet to find an answer that works for me.

Essentially, I need to find the average daily volume for my indexes in the last ~30 days. I also need to find out how the indexes are being used and by whom.

Any information would be greatly appreciated. Thank you for your help

Re: Details on indexes

knutsod — Mon, 28 Sep 2020 18:39:05 GMT

For the index usage, use this search to get started:

index=_internal source="*metrics.log" group="per_index_thruput" | timechart span=1d sum(kb) by series

Re: Details on indexes

aljohnson_splun — Fri, 16 Jan 2015 22:08:47 GMT

Daily Volume for Indexes

Check out S.o.S. (Splunk on Splunk) ! It's a free app.

`set_internal_index` host="some_host" source=*metrics.log group="per_index_thruput"
                | bin _time 
                | stats sum(kb) AS KB by series,_time
                | timechart minspan=30s  avg(eval(round(KB/1024/1024,2))) by series

You could then change sum (like the image) to avg (in the code above).

Index Access & Usage

It sounds like you want to explore the _internal index!

See this documentation for lots of information.

Re: Details on indexes

martin_mueller — Sun, 18 Jan 2015 00:44:30 GMT

Additionally, if you're on 6.2.x, check out the Distributed Management Console that ships since this version. It has many great base statistics you can work off from.