Get todays Indexing Volume using the cli

[FRoth]

Is there a way to retrieve the indexing volume of the current day using the CLI?

[kristian_kolb]

I guess you can use the rest search for that from the CLI.

Try:

./splunk search "| rest /services/licenser/pools | fields + title used_bytes"

And work from there - also check out the docs for the REST API;
http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTcontents

Hope this helps,

Kristian

[kristian_kolb]

oops, my bad. Thanks Drainy.

[Drainy]

Don't include the space, so "| rest

[FRoth]

It says:
FATAL: Error in 'rest' command: This command must be the first command of a search.