Monitoring Splunk

DBinspect vs rest call

kiamyash
Engager

I am running 2 search:

 

| rest splunk_server=* /services/data/indexes-extended | search title = _internal
| stats max(bucket_dirs.home.warm_bucket_count) by title

| dbinspect index=_internal | search state = warm | stats count

Both are run for all time, why am i getting different count of warm data.

Also, my max warm bucket count is restriceted to 450, while rest api call is giving me a no below this, dbinspect is giving me 2550. How is this possible.

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

total number of buckets are depending on how many indexers you have and replication factor.

for example if you have 4 indexers, max total number of buckets would be 450*4.

I have run searches you have shared in my standard alone box. its giving exact same results.

dbinspect.pngrest.png

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...