Archive

Search for the volume of data ingested into a specific index in MB

Engager

I have spent hours today researching and testing all sort of searches and I just cannot figure out how to find the information I want. I would have thought it would have been straight forward to find the total volume of data sent to a specific index in MB.

I have came close but only by experimenting with many examples I found on the site.

Any advice would be very much appreciated.

Thank you!

Tags (1)
0 Karma
1 Solution

Revered Legend

Try this (gives the amount of license used for indexes)

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
| stats sum(b) as bytes by idx | eval mb=round(bytes/1024/1024,3)

View solution in original post

Esteemed Legend
0 Karma

Revered Legend

Try this (gives the amount of license used for indexes)

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
| stats sum(b) as bytes by idx | eval mb=round(bytes/1024/1024,3)

View solution in original post

Explorer

How to check the daily indexing in such cases ? Would adding span=1d and a timechart help?

0 Karma

Revered Legend

If you want overall, then you can use this timechart version

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
 | timechart span=1d sum(b) as usage_mb| eval usage_mb=round(usage_mb/1024/1024,3)

For per index, you can use this

  index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
     | timechart span=1d sum(b) as usage by idx limit=0 | foreach * [ eval "<<FIELD>>"=round('<<FIELD>>'/1024/1024,3)]

OR

 index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
     | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval mb=round(bytes/1024/1024,3)
0 Karma

Engager

This is absolutely perfect thank you very much. I have what I am looking for and I have learnt more about how to query in Splunk!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!