Can you confirm this search will be accruate in determining how many gigs I am using?

[daniel333]

All,

I can't get access to admin tools on this instance of Splunk, just want to confirm this LEN command is accurate within reason for determining gigs used?

example -
index=pcf | eval total=len(_raw) | eval mygigs=1024/1024/1024 | stats sum(mygigs)

[adonio]

i will assume you are looking for license usage
if that is the case, i would say it is accurate enough. if the text formatting is not plain english, it can be off.
however, you can use the |dbinspect command as i think you dont have to be an admin
try this and adjust your timepicker:

| dbinspect
| search index=YOUR_INDEX
| stats sum(rawSize) as raw_size sum(sizeOnDiskMB) as commited_to_disk by index
| eval raw_gb = round(raw_size/1024/1024/1024, 2), committed_gb = round(commited_to_disk/1024, 2)

hope it helps