Generating data for the average index usage compared to the total index provisioned storage

[jward6004]

Generating data for the average index usage compared to the total index provisioned storage. For majority of our indexes we provision 1,900,000 of 'Max size (MB) of entire index'. I would like to gather information on the average that each index uses compared to this max storage space given to the index. This will let us know which index that we can redistribution to higher volume index and for planning/scaling on creation of future indexes.

[jbjerke_splunk]

Hi jward6004

You can use the internal rest commands in Splunk for this.

Try this search:

| rest /services/data/indexes count=0| table title homePath_expanded currentDBSizeMB maxTotalDataSizeMB | eval "Usage(%)"=round(100*(currentDBSizeMB/maxTotalDataSizeMB),2)

j

[masonmorales]

What version of SUM are you using?

[jward6004]

Version 2.0