What is the exact Splunk DB path in Email Security Appliance?

[dhsetty]

Hello All,

Currently we are using Splunk with Email Security Appliance.
All I know is the command ---> du -sk /data/db/splunk , to know the space consumed by Splunk DB.

But could you please help me with the path of Splunk, where Message Tracking, Reporting data is stored in Email Security Appliance.

Thanks & Regards,
Dharmendra Setty

[lguinn2 · Accepted solution]

Cisco sells an email security appliance; this device produces log files of its activity. Splunk has an app that understands the logs from the Cisco ESA: Splunk Add-on for Cisco ESA The documentation for the Splunk Add-on for Cisco ESA is here

When you set up the Splunk inputs, you choose the index for the Cisco ESA data. And in indexes.conf on the indexer(s), you specify where disk space is allocated for the indexes.

You can use the Splunk Monitoring Console to see how much disk space is used by each index. But you will have to look at your configuration to determine where the Cisco ESA data is stored.

[dhsetty]

Hi Iguinn[Splunk],

How to use the Splunk Monitoring Console, to see the disk space usage by each index.

Can you please share me the steps on usage of Splunk Monitoring Console.

Thanks & Regards,
Dharmendra Setty

[dhsetty]

Also my requirement is:

Suppose I make a Splunk DB Query as below:
a=1
b=1000

search_parms = {'date_from': '1/10/2016:05:00', 'start': a, 'stop': b, 'timeout': 60, 'date_to': '02/22/2017:23:39', 'mask_prvs': 0, 'maxresults': 100000},

So, the Splunk response is bucketed output grouping based on MIDs.
a. How to delete these results from Splunk DB which are indexed?
b. How to find the Splunk DB storage space after deleted?

Thanks & Regards,
Dharmendra Setty