Hello,
im trying to create an alert if any of the indexes i have is filled up with more than 90 % of it space? I found something but it gives results of the actual size of the indexes
| eventcount summarize=false report_size=true index=* | eval size_MB=size_bytes/(1024*1024)
but nothing regarding on the percentage that is used. maybe there is an app i can install that has this kind of searches ?
Any clue on this ?
Hi arber,
you can use this REST search:
| rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc
and create an alert out of it.
hope this helps ...
cheers, MuS
Hi arber,
you can use this REST search:
| rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc
and create an alert out of it.
hope this helps ...
cheers, MuS
Never mind i found it 🙂 . Just add the splunk_server
| rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc splunk_server
Hi ,
I would like to set up alert for only one specific index..this query shows all the index. Please let me know how can i get it only for that specific index?
Thanks
un-tested since no Splunk available at this time of the day; but try:
| rest /services/data/indexes | search title=TheIndexYouWant | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc
hey,
it is working... Thanks!!
Feel free to up-vote this comment and/or answer 😉
Im trying to run this from our main splunk instance. Basically it shows all indexes of all indexers that we have in our infrastructure. But is there a way to tell that this index is from this indexer and so.. Because at the moment with this command you cannot get this info..
use splunk_server
for the REST command http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Rest
thanks a lot
Thanks a lot it works