Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to find index size before splunk adding indexe...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have 10 indexes...i want to find the actual size of the index before splunk adding its indexing.
and after as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need dbinspect and the rawSize field:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect
Try this:
|dbinspect index=a OR index=b OR ... OR index=z | table index rawSize
You might also check out the Fire Brigade app:
https://splunkbase.splunk.com/app/1632/
Or your Monitoring Console:
https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/DMCoverview
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need dbinspect and the rawSize field:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect
Try this:
|dbinspect index=a OR index=b OR ... OR index=z | table index rawSize
You might also check out the Fire Brigade app:
https://splunkbase.splunk.com/app/1632/
Or your Monitoring Console:
https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/DMCoverview
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks ..I think I should look do a course to become SPlunk Admin...
From sample Query started (Just write Query and that is the end...)---> dont know how far i will go into SPlunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Look at the dbinspect command.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks -- sorry been busy with wrk
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Observability Simplified: Combining User Experience, Application Performance & ...
Event Series May & June: From Network Visibility to Service Intelligence
