Monitoring Splunk

DBinspect vs rest call

kiamyash
Engager

I am running 2 search:

 

| rest splunk_server=* /services/data/indexes-extended | search title = _internal
| stats max(bucket_dirs.home.warm_bucket_count) by title

| dbinspect index=_internal | search state = warm | stats count

Both are run for all time, why am i getting different count of warm data.

Also, my max warm bucket count is restriceted to 450, while rest api call is giving me a no below this, dbinspect is giving me 2550. How is this possible.

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

total number of buckets are depending on how many indexers you have and replication factor.

for example if you have 4 indexers, max total number of buckets would be 450*4.

I have run searches you have shared in my standard alone box. its giving exact same results.

dbinspect.pngrest.png

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...