Installation

How do I determine my indexing volume by host, source, or sourcetype?

matt
Splunk Employee
Splunk Employee

I need to know the breakdown of my license consumption on a per host, per source, and per sourcetype basis. What is the search to do this?

Labels (1)
1 Solution

ziegfried
Influencer

per host:

index="_internal" source="*metrics.log" group="per_host_thruput" | chart sum(kb) by series | sort - sum(kb)

per source:

index="_internal" source="*metrics.log" group="per_source_thruput" | chart sum(kb) by series | sort - sum(kb)

per sourcetype:

index="_internal" source="*metrics.log" group="per_sourcetype_thruput" | chart sum(kb) by series | sort - sum(kb)

View solution in original post

wharmsworth
Engager
index=_internal source="*license_usage.log" type=usage type=Usage idx=* pool="Your Pool Name" earliest=-30d@d latest=@d
| eval GB = b
| timechart limit=50 partial=false span=1d sum(eval(GB/1024/1024/1024)) by idx

This works well for me.

0 Karma

sideview
SplunkTrust
SplunkTrust

In the search app that Splunk ships with, under 'Status', there is a view called 'Indexing volume'. Go there and you'll see that it offers precisely this -- you can see your indexing volume broken down over time by source, by sourcetype, by host or by index.

Some raw searches themselves are posted in another answer but you'll probably find the custom view the most useful.

damode
Motivator

Hi @sideview,
Can you please point where exactly the status option is displayed on the Search and Reporting page of Splunk ?

Thanks

0 Karma

ziegfried
Influencer

per host:

index="_internal" source="*metrics.log" group="per_host_thruput" | chart sum(kb) by series | sort - sum(kb)

per source:

index="_internal" source="*metrics.log" group="per_source_thruput" | chart sum(kb) by series | sort - sum(kb)

per sourcetype:

index="_internal" source="*metrics.log" group="per_sourcetype_thruput" | chart sum(kb) by series | sort - sum(kb)

Simeon
Splunk Employee
Splunk Employee
0 Karma

Simeon
Splunk Employee
Splunk Employee

While the above search will work for most cases, only the top 10 values over 30 second periods are indexed by default. For this reason, you may not see low volume hosts populating the search results. You can increase the number of data points for the metrics.log file by editing the samples taken within limits.conf. See the following link and look for "metrics":

http://www.splunk.com/base/Documentation/latest/Admin/Limitsconf

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...