HOW TO CALCULATE LOG SAVE ON INDEXER

[jacknguyen]

Hi guys,

My boss check on Splunk Master and see that, he want to know  index, source, sourcetype, capacity of log/day for each sourcetype, How can I see that

I used this search before, but I feel its not corect 100%,

| dbinspect index=*
| stats sum(rawSize) as total_size by index
| eval total_size_mb = total_size / (1024 * 1024)
| table index total_size_mb

How I can check  this on my Indexer, I can ssh to Indexer too.
Thank you for your time

[gcusello]

Hi @jacknguyen ,

if you use the Monitoring Console or the License consuption dashboard, you can have these information.

Ciao.

Giuseppe

[jacknguyen]

I cannot access the License Master, I also check Monitoring console in Index volume and instance, no result founds. 

[gcusello]

Hi @jacknguyen,

in the monitoring Console at [Indexing > License Usage > Historic License usage ] you can display the license usage split by index or sourcetype, etc...

If this doesn't exactly answer to your question, you can start from this search to customize your own.

Ciao.

Giuseppe 

[jacknguyen]

I cannot see anything. Do you know the search can check this?

[gcusello]

Hi @jacknguyen,

this isn't the dashboard I indicated, becsuase you need the historic license consuption not the daily one, anyway, you have a configuration issue on your Monitoring Console, I hint to open a case to Splunk Support for this, otherwise, you cannot solve your request.

Ciao.

Giuseppe

[jacknguyen]

I use this search

| dbinspect index=*
| stats sum(rawSize) as total_size by index
| eval total_size_mb = total_size / (1024 * 1024)
| table index total_size_mb

and get this result is this right?

[gcusello · Accepted solution]

Hi @jacknguyen,

yes, it should be right, what's the problem?

Ciao.

Giuseppe

[gcusello]

Hi @jacknguyen ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉