Getting Data In

log file size Vs license size per day by specific index

ips_mandar
Builder

Hi,
I have one forwarederand one (IDX+SH). I am ingesting few hundreads of .txt files from HWF to one specific index. Now I want to know what log file size actually it has indexed per day vs what license volume it consumed per day for particular index.
Can any one help me with spl query? and is it possible to get actual .txt file size from splunk?
Thanks,

0 Karma

ips_mandar
Builder

hey splunkers, is there any way by which I can calculate splunk indexed actual log file size per day?
thanks,

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Yes, run the following search to get the info you are looking for:

|tstats count where index=* by source

Or replace "index=*" with the name of the index you are interested in.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

ips_mandar
Builder

@codebuilder It will provide count of lines by source but I want how much log size data(in MB/GB) is got indexed per day by specific index vs total license size (MB/GB) utilization per day.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Try this:

index=_internal sourcetype=splunkd component=LicenseUsage idx=replace_with_your_index_name
| timechart span=1d sum(b) as Usage | eval Usage=round(Usage/1024/1024/1024,2)

Also, both the DMC and Master provide nice dashboards for monitoring both.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

ips_mandar
Builder

@codebuilder, Thanks but above query will provide license usage and I also want actual log file size which splunk has indexed per day. is it possible?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!