What is the splunk query to display disk space utilized by each app in splunk

[monyathomas]

I tried to use this query -
index=_internal metrics kb group=per_sourcetype_thruput | eval sizeMB = round(kb/1024,2)| stats sum(sizeMB) by series | sort -sum(sizeMB) | rename sum(sizeMB) AS "Size on Disk (MB)"

But the above doesnt display it app wise and if i try 'app' instead of 'series' in the above query, it doesnt help.

Kindly help me with a query to dispay disk space utilization app wise

[Richfez]

Right. You are asking for "per sourcetype" throughput. A sourcetype can be shared across many apps. In fact, sourcetypes really have nothing to do with apps; though they're occasionally defined in an app, usually the sourcetype is set on the input which is often on a machine entirely separate from the things that you, as a user, would usually recognize as an app (I.e. it's on a Universal Forwarder somewhere).

An App, as you are probably thinking about it, exists way up higher in the stack.
On the bottom you have data collection. E.g. "inputs"
Those feed data into indexes, tagged with a variety of information like host, source, sourcetype, etc...
Someone decides certain data needs customization - adding fields, lookups, whatever - so they create an app as a container to hold all those customizations, but at this point it's just a way to keep track of things and keep similar things in the same place.
Now that they have it tweaked a bit, they build some searches and dashboards, which are also saved in the app and give it a structure for users. This is probably what you are referring to as an App.

So, throughputs are happening on the inputs level (and you could redefine it a bit and have it work on the index level, but that's not really important for this discussion because it's still not what you are looking for), so "by app" splitting of those doesn't really make sense.

If you run this search, you'll see that there's no internal metrics on kb that's based on apps.

index=_internal metrics kb 
| stats count by group

The reason that trying to use 'app' inside your search instead of 'series' doesn't work is simple - the data doesn't HAVE 'app' in it. This has nothing whatsoever to do with your goal of displaying these by app, it's simply what is or is not in the data. Take a look at just

index=_internal metrics kb 

And you'll notice there's no field called "app", hence why you can't use it in the by clause of stats.

You COULD poke around in the MC (click Settings, then pick the Monitoring Console from the left side of that menu), but I am pretty sure you'll not find data volumes by app because of the above distinctions.

You can though find it by index or sourcetype, so maybe one of those helps?

Anyway, Happy Splunking!
-Rich