Getting Data In

How to find index size before splunk adding indexes...i mean raw data size

jw44250
New Member

I have 10 indexes...i want to find the actual size of the index before splunk adding its indexing.

and after as well.

0 Karma
1 Solution

woodcock
Esteemed Legend

You need dbinspect and the rawSize field:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect

Try this:

|dbinspect index=a OR index=b OR ... OR index=z | table index rawSize

You might also check out the Fire Brigade app:
https://splunkbase.splunk.com/app/1632/
Or your Monitoring Console:
https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/DMCoverview

View solution in original post

0 Karma

woodcock
Esteemed Legend

You need dbinspect and the rawSize field:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Dbinspect

Try this:

|dbinspect index=a OR index=b OR ... OR index=z | table index rawSize

You might also check out the Fire Brigade app:
https://splunkbase.splunk.com/app/1632/
Or your Monitoring Console:
https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/DMCoverview

0 Karma

jw44250
New Member

Thanks ..I think I should look do a course to become SPlunk Admin...

From sample Query started (Just write Query and that is the end...)---> dont know how far i will go into SPlunk

0 Karma

somesoni2
Revered Legend
0 Karma

jw44250
New Member

thanks -- sorry been busy with wrk

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...