Getting Data In

How to determine index volume by sourcetype?

echojacques
Builder

Hello,

How can I determine the index volume by sourcetype? The reason why I ask is because occasionally I'll have a big spike in my index volume that threatens my license cap and I'm trying to find the best way to determine the cause of the spike. If I can create a chart that shows volume by sourcetype (over X hours) then I can identify the culprit and dig in from there.

Or even better, is there a search that I can run that actually identifies the cause of the spike (not just the sourectype)?

Thanks!

1 Solution

ykherianDEPRECA
Splunk Employee
Splunk Employee

Trust the license usage (not the metrics) form the license-master.

Example for the size for yesterday

earliest=-1d@d latest=@d  index=_internal source=*license_usage.log* type=Usage 
| stats sum(b) AS Bytes by st 
| sort -Bytes

see more here : http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

View solution in original post

ykherianDEPRECA
Splunk Employee
Splunk Employee

Trust the license usage (not the metrics) form the license-master.

Example for the size for yesterday

earliest=-1d@d latest=@d  index=_internal source=*license_usage.log* type=Usage 
| stats sum(b) AS Bytes by st 
| sort -Bytes

see more here : http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

echojacques
Builder
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...