Monitoring Splunk

DBinspect vs rest call

kiamyash
Engager

I am running 2 search:

 

| rest splunk_server=* /services/data/indexes-extended | search title = _internal
| stats max(bucket_dirs.home.warm_bucket_count) by title

| dbinspect index=_internal | search state = warm | stats count

Both are run for all time, why am i getting different count of warm data.

Also, my max warm bucket count is restriceted to 450, while rest api call is giving me a no below this, dbinspect is giving me 2550. How is this possible.

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

total number of buckets are depending on how many indexers you have and replication factor.

for example if you have 4 indexers, max total number of buckets would be 450*4.

I have run searches you have shared in my standard alone box. its giving exact same results.

dbinspect.pngrest.png

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...