Getting Data In

How to get the daily indexed volume for Splunk on Ubuntu with a bash script?

benziebgpcl
New Member

Hi,

I'd like to be able to monitor the amount of data indexed daily (ie, "so far today") so I can surface this up to users of our NMS (who don't necessarily have access to our Splunk instances).

How can I get the amount of data indexed today (or more specifically, Today's License Usage) via a bash script?

Thanks,
Brett

0 Karma
1 Solution

MuS
Legend

Hi benziebgpcl,

you can run Splunk searches from the CLI or shell script like this as user splunk:

splunk@indexer:~ $ /opt/splunk/bin/splunk search "| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024/1024,3) | eval totalGB=round(total/1024/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top" -auth username:password

  x   y1 y2   y3     y4
----- -- -- ------ ------
0.393  0  8 10.000 10.001
splunk@indexer:~ $ 

build a wrapper script around it and your done.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi benziebgpcl,

you can run Splunk searches from the CLI or shell script like this as user splunk:

splunk@indexer:~ $ /opt/splunk/bin/splunk search "| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024/1024,3) | eval totalGB=round(total/1024/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top" -auth username:password

  x   y1 y2   y3     y4
----- -- -- ------ ------
0.393  0  8 10.000 10.001
splunk@indexer:~ $ 

build a wrapper script around it and your done.

Hope this helps ...

cheers, MuS

MuS
Legend

and x would be today's index volume and y3 the license size

0 Karma

benziebgpcl
New Member

Awesome, thanks MuS, exactly what I was hoping for.

Cheers,
Brett

0 Karma

Mohsin123
Path Finder

Hi, pls tell me wats x,y1,y2,y3,y4

0 Karma

MuS
Legend

If you remove the last | gauge ... search command you will see what each of the values represent. But here is the what they mean:

x = usedGB (License usage for today)
y1 = gauge_base (License base)
y2 = gauge_danger  (License usage 80% of total license size)
y3 = totalGB (License total size)
y4 = gauge_top (License total size plus 1Kb)

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...