Installation
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Daily log usage

jwjorgensen
Engager

Hello,

Can anyone tell me where I would go to find daily log storage info? I am trying to get an average of how much storage per day is currently being used, so I can figure out what license I would need to purchase.

Any info is much appreciated!

Jesse Jorgensen

Labels (1)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

This search will show you the amount of data for your indexes for 1 day.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0

Also in the UI you can go to the Search App -> Status (menu) -> Index Activity -> Indexing Volume. The Splunk on Splunk App also provides all of the details in addition to the health of your environment.

http:///en-US/app/search/indexing_volume

View solution in original post

edriggers
New Member

The search above got me started in the right direction. I find this outputs the data in a more elegant format:

index=_internal source=*license_usage.log
earliest=-24h
| eval GB=round(b/1024/1024/1024, 2)
| stats sum(GB) count by st
| sort - sum(GB)

0 Karma

sdaniels
Splunk Employee
Splunk Employee

This search will show you the amount of data for your indexes for 1 day.

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by st useother=0

Also in the UI you can go to the Search App -> Status (menu) -> Index Activity -> Indexing Volume. The Splunk on Splunk App also provides all of the details in addition to the health of your environment.

http:///en-US/app/search/indexing_volume

View solution in original post

jwjorgensen
Engager

That's just what I needed. Thanks for your help!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!