Installation

Daily log usage

jwjorgensen
Engager

Hello,

Can anyone tell me where I would go to find daily log storage info? I am trying to get an average of how much storage per day is currently being used, so I can figure out what license I would need to purchase.

Any info is much appreciated!

Jesse Jorgensen

Labels (1)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

This search will show you the amount of data for your indexes for 1 day.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0

Also in the UI you can go to the Search App -> Status (menu) -> Index Activity -> Indexing Volume. The Splunk on Splunk App also provides all of the details in addition to the health of your environment.

http:///en-US/app/search/indexing_volume

View solution in original post

edriggers
New Member

The search above got me started in the right direction. I find this outputs the data in a more elegant format:

index=_internal source=*license_usage.log
earliest=-24h
| eval GB=round(b/1024/1024/1024, 2)
| stats sum(GB) count by st
| sort - sum(GB)

0 Karma

sdaniels
Splunk Employee
Splunk Employee

This search will show you the amount of data for your indexes for 1 day.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0

Also in the UI you can go to the Search App -> Status (menu) -> Index Activity -> Indexing Volume. The Splunk on Splunk App also provides all of the details in addition to the health of your environment.

http:///en-US/app/search/indexing_volume

jwjorgensen
Engager

That's just what I needed. Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...