Getting Data In
Highlighted

Get todays Indexing Volume using the cli

Contributor

Is there a way to retrieve the indexing volume of the current day using the CLI?

Tags (3)
0 Karma
Highlighted

Re: Get todays Indexing Volume using the cli

Ultra Champion

I guess you can use the rest search for that from the CLI.

Try:

./splunk search "| rest /services/licenser/pools | fields + title used_bytes"

And work from there - also check out the docs for the REST API;
http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTcontents

Hope this helps,

Kristian

Highlighted

Re: Get todays Indexing Volume using the cli

Contributor

It says:
FATAL: Error in 'rest' command: This command must be the first command of a search.

0 Karma
Highlighted

Re: Get todays Indexing Volume using the cli

Champion

Don't include the space, so "| rest

0 Karma
Highlighted

Re: Get todays Indexing Volume using the cli

Ultra Champion

oops, my bad. Thanks Drainy.