Hello All,
Currently we are using Splunk with Email Security Appliance.
All I know is the command ---> du -sk /data/db/splunk , to know the space consumed by Splunk DB.
But could you please help me with the path of Splunk, where Message Tracking, Reporting data is stored in Email Security Appliance.
Thanks & Regards,
Dharmendra Setty
Cisco sells an email security appliance; this device produces log files of its activity. Splunk has an app that understands the logs from the Cisco ESA: Splunk Add-on for Cisco ESA The documentation for the Splunk Add-on for Cisco ESA is here
When you set up the Splunk inputs, you choose the index for the Cisco ESA data. And in indexes.conf on the indexer(s), you specify where disk space is allocated for the indexes.
You can use the Splunk Monitoring Console to see how much disk space is used by each index. But you will have to look at your configuration to determine where the Cisco ESA data is stored.
Cisco sells an email security appliance; this device produces log files of its activity. Splunk has an app that understands the logs from the Cisco ESA: Splunk Add-on for Cisco ESA The documentation for the Splunk Add-on for Cisco ESA is here
When you set up the Splunk inputs, you choose the index for the Cisco ESA data. And in indexes.conf on the indexer(s), you specify where disk space is allocated for the indexes.
You can use the Splunk Monitoring Console to see how much disk space is used by each index. But you will have to look at your configuration to determine where the Cisco ESA data is stored.
Hi Iguinn[Splunk],
How to use the Splunk Monitoring Console, to see the disk space usage by each index.
Can you please share me the steps on usage of Splunk Monitoring Console.
Thanks & Regards,
Dharmendra Setty
Also my requirement is:
Suppose I make a Splunk DB Query as below:
a=1
b=1000
search_parms = {'date_from': '1/10/2016:05:00', 'start': a, 'stop': b, 'timeout': 60, 'date_to': '02/22/2017:23:39', 'mask_prvs': 0, 'maxresults': 100000},
So, the Splunk response is bucketed output grouping based on MIDs.
a. How to delete these results from Splunk DB which are indexed?
b. How to find the Splunk DB storage space after deleted?
Thanks & Regards,
Dharmendra Setty