Archive
Highlighted

Need to generate sparkline charts on daily index disk usages for each index in table.

New Member

Hi,

I would like to generate sparkline charts for each index in the table. The sparkline should show the daily index disk usages. So that it would help to know the disk usage for each index over a period of time.

Could someone please help me to figure out the search string for it ?

Thanks,
Sajeesh

Tags (1)
0 Karma
Highlighted

Re: Need to generate sparkline charts on daily index disk usages for each index in table.

Contributor

UPDATED ANSWER:

Hi Sajeesh,
you could try this:

index=_introspection sourcetype=splunk_disk_objects component=Indexes data.name=*
| eval data_birth_date = if(isnotnull('data.bucket_dirs.cold.event_min_time'), 'data.bucket_dirs.cold.event_min_time', 'data.bucket_dirs.home.event_min_time')
| eval data_age_days = round((_time - data_birth_date) / 86400, 0)
| eval data.total_capacity = if(isnotnull('data.total_capacity'), 'data.total_capacity', 500000)
| eval disk_usage = round('data.total_size', 2)
| eval disk_capacity = round('data.total_capacity' / 1024, 2) 
| stats max(disk_usage) as disk_usage sparkline(max(disk_usage), 1d) as trend by data.name

Does this fit your needs?

ORIGINAL ANSWER:
Hi Sajeesh,
you could try this:

index=_internal  source=*license_usage.log type=Usage | eval MB = b/1024/1024 | chart sum(MB) as MB sparkline(sum(MB), 1d) as trend by idx

Does this fit your needs?

View solution in original post

0 Karma
Highlighted

Re: Need to generate sparkline charts on daily index disk usages for each index in table.

New Member

Each index's disk usage will it be the same as the values ('b') derived from license_usage.log ?

How about using "| db_inspect" for each index and getting the 'sizeOnDiskMB' value for each day and plotting it?

0 Karma
Highlighted

Re: Need to generate sparkline charts on daily index disk usages for each index in table.

Contributor

Hi Sajeesh,
you are right the license volume is not the volume on the disk.

this here should do it.

index=_introspection sourcetype=splunk_disk_objects component=Indexes data.name=*
| eval data_birth_date = if(isnotnull('data.bucket_dirs.cold.event_min_time'), 'data.bucket_dirs.cold.event_min_time', 'data.bucket_dirs.home.event_min_time')
| eval data_age_days = round((_time - data_birth_date) / 86400, 0)
| eval data.total_capacity = if(isnotnull('data.total_capacity'), 'data.total_capacity', 500000)
| eval disk_usage = round('data.total_size', 2)
| stats max(disk_usage) as disk_usage sparkline(max(disk_usage), 1d) as trend by data.name

the one above measures in MB if you want your data in GB you have to change this line: "| eval diskusage = round('data.totalsize', 2)" to "| eval diskusage = round('data.totalsize' / 1024 , 2)"

0 Karma
Highlighted

Re: Need to generate sparkline charts on daily index disk usages for each index in table.

New Member

Thank you, this answer is similar to what I expected.

0 Karma