Archive

search to find total amount in a particular index

Explorer

Im looking to find the total amount of data that was ingested for a particular index. We usually use out deployment server for this but it only shows me the top 10 indexes. I need to find an index that is not in the top 10.

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

The slowest but typically the most accurate method is to do a search like this:

<your data> | eval len = len(_raw) | stats sum(len) as totalBytes

As woodcock said, use the dashboards in the monitoring console. You can split by indexer etc.

0 Karma

Esteemed Legend

You should setup a Monitoring Console and it has everything that you can imagine.

Explorer

so today we use the monitoring console to check current and past license usage but that still only shows me the top 10 indexes. is there a way through the MC to look at just one index?

0 Karma

Esteemed Legend

Just hover in the lower right and click on open in new search and you can modify any search to do what you need (get more than just 10).

0 Karma