Getting Data In
Highlighted

log file size Vs license size per day by specific index

Contributor

Hi,
I have one forwarederand one (IDX+SH). I am ingesting few hundreads of .txt files from HWF to one specific index. Now I want to know what log file size actually it has indexed per day vs what license volume it consumed per day for particular index.
Can any one help me with spl query? and is it possible to get actual .txt file size from splunk?
Thanks,

0 Karma
Highlighted

Re: log file size Vs license size per day by specific index

Motivator

Yes, run the following search to get the info you are looking for:

|tstats count where index=* by source

Or replace "index=*" with the name of the index you are interested in.

0 Karma
Highlighted

Re: log file size Vs license size per day by specific index

Contributor

@codebuilder It will provide count of lines by source but I want how much log size data(in MB/GB) is got indexed per day by specific index vs total license size (MB/GB) utilization per day.

0 Karma
Highlighted

Re: log file size Vs license size per day by specific index

Motivator

Try this:

index=_internal sourcetype=splunkd component=LicenseUsage idx=replace_with_your_index_name
| timechart span=1d sum(b) as Usage | eval Usage=round(Usage/1024/1024/1024,2)

Also, both the DMC and Master provide nice dashboards for monitoring both.

0 Karma
Highlighted

Re: log file size Vs license size per day by specific index

Contributor

@codebuilder, Thanks but above query will provide license usage and I also want actual log file size which splunk has indexed per day. is it possible?

0 Karma
Highlighted

Re: log file size Vs license size per day by specific index

Contributor

hey splunkers, is there any way by which I can calculate splunk indexed actual log file size per day?
thanks,

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.