How to get the daily indexed volume for Splunk on Ubuntu with a bash script?

[benziebgpcl]

Hi,

I'd like to be able to monitor the amount of data indexed daily (ie, "so far today") so I can surface this up to users of our NMS (who don't necessarily have access to our Splunk instances).

How can I get the amount of data indexed today (or more specifically, Today's License Usage) via a bash script?

Thanks,
Brett

[MuS · Accepted solution]

Hi benziebgpcl,

you can run Splunk searches from the CLI or shell script like this as user splunk:

splunk@indexer:~ $ /opt/splunk/bin/splunk search "| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | join type=outer stack_id [rest splunk_server=local /services/licenser/stacks | eval stack_id=title | eval stack_quota=quota | fields stack_id stack_quota] | stats sum(used_bytes) as used max(stack_quota) as total | eval usedGB=round(used/1024/1024/1024,3) | eval totalGB=round(total/1024/1024/1024,3) | eval gauge_base=0 | eval gauge_danger=totalGB*0.8 | eval gauge_top=totalGB+0.001 | gauge usedGB gauge_base gauge_danger totalGB gauge_top" -auth username:password

  x   y1 y2   y3     y4
----- -- -- ------ ------
0.393  0  8 10.000 10.001
splunk@indexer:~ $ 

build a wrapper script around it and your done.

Hope this helps ...

cheers, MuS

[MuS]

and x would be today's index volume and y3 the license size

[benziebgpcl]

Awesome, thanks MuS, exactly what I was hoping for.

Cheers,
Brett

[Mohsin123]

Hi, pls tell me wats x,y1,y2,y3,y4

[MuS]

If you remove the last | gauge ... search command you will see what each of the values represent. But here is the what they mean:

x = usedGB (License usage for today)
y1 = gauge_base (License base)
y2 = gauge_danger  (License usage 80% of total license size)
y3 = totalGB (License total size)
y4 = gauge_top (License total size plus 1Kb)

cheers, MuS