Is there a way to see how much data we are getting in from Active Directory, Exchange and Radius (size of the indexes/number of days the data goes back)?

[dkr3500]

Is there a way to see how much data we are getting in from Active Directory, Exchange and Radius (size of the indexes/number of days the data goes back)?

Splunk version: 6.5.3
Enterprise distributed environment.

[jdhunter · Accepted solution]

Do you have all the data going to one index? Have you created a separate index for each? Have you setup the Monitoring Console for your deployment? If you haven't setup the Monitoring Console, I would set that up. There is a lot of valuable information about your Splunk Environment to be gained.

https://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/DMCoverview

If you have the Monitoring Console Setup, Navigate to Monitoring Console > Indexing > Indexes and Volumes > Index Detail: Deployment > Filter on the Index of Interest.

This dashboard gives you an Overview of your data for that Index including Size and Median Data age.

[adonio]

look at the | dbinspect command:
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Dbinspect