Getting Data In

What is the exact Splunk DB path in Email Security Appliance?

Explorer

Hello All,

Currently we are using Splunk with Email Security Appliance.
All I know is the command ---> du -sk /data/db/splunk , to know the space consumed by Splunk DB.

But could you please help me with the path of Splunk, where Message Tracking, Reporting data is stored in Email Security Appliance.

Thanks & Regards,
Dharmendra Setty

Tags (1)
0 Karma
1 Solution

Legend

Cisco sells an email security appliance; this device produces log files of its activity. Splunk has an app that understands the logs from the Cisco ESA: Splunk Add-on for Cisco ESA The documentation for the Splunk Add-on for Cisco ESA is here

When you set up the Splunk inputs, you choose the index for the Cisco ESA data. And in indexes.conf on the indexer(s), you specify where disk space is allocated for the indexes.

You can use the Splunk Monitoring Console to see how much disk space is used by each index. But you will have to look at your configuration to determine where the Cisco ESA data is stored.

View solution in original post

0 Karma

Legend

Cisco sells an email security appliance; this device produces log files of its activity. Splunk has an app that understands the logs from the Cisco ESA: Splunk Add-on for Cisco ESA The documentation for the Splunk Add-on for Cisco ESA is here

When you set up the Splunk inputs, you choose the index for the Cisco ESA data. And in indexes.conf on the indexer(s), you specify where disk space is allocated for the indexes.

You can use the Splunk Monitoring Console to see how much disk space is used by each index. But you will have to look at your configuration to determine where the Cisco ESA data is stored.

View solution in original post

0 Karma

Explorer

Hi Iguinn[Splunk],

How to use the Splunk Monitoring Console, to see the disk space usage by each index.

Can you please share me the steps on usage of Splunk Monitoring Console.

Thanks & Regards,
Dharmendra Setty

0 Karma

Explorer

Also my requirement is:

Suppose I make a Splunk DB Query as below:
a=1
b=1000

search_parms = {'date_from': '1/10/2016:05:00', 'start': a, 'stop': b, 'timeout': 60, 'date_to': '02/22/2017:23:39', 'mask_prvs': 0, 'maxresults': 100000},

So, the Splunk response is bucketed output grouping based on MIDs.
a. How to delete these results from Splunk DB which are indexed?
b. How to find the Splunk DB storage space after deleted?

Thanks & Regards,
Dharmendra Setty

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!