event number from _internal index

[Splunk_U]

I need to know the number of event by the index os from the _internal index

[yannK]

I would not trust the metrics for any type of calculation of volume, for the simple reason that metrics.log measure only the top 10 sample.

If you really want to know the current number of events in a particular index , use the | dbinspect index=myindex command on your indexers.

[kristian_kolb]

I don't think that information is present in _internal, at least not the exact number of events. You could probably find some approximation by looking at the metrics logs (in _internal). The search below will tell you the daily amount of events per index (non-internal indexes only).

index=_internal sourcetype=splunkd component=Metrics group=per_index_thruput series!=_* | timechart span=1d sum(ev) by series

Hope this helps,

K

[Splunk_U]

I have modified the query as I need the internal index data also..

index=_internal sourcetype=splunkd component=Metrics group=per_index_thruput series=* | stats sum(ev) by series, host

Now I have made all the data from the UF, Search Head to go to a particular Indexer. So the above query is giving the data for that Indexer only. Can I distinctly that from which original host the data is comming. I tried to use sourceHost but its not working

[Splunk_U]

I want to build a search query on _internal index that will tell me the number of events per every other indexes (like os, custom index) present on the server.

[kristian_kolb]

Manager -> indexes will show the number of events per index. If this is not what you want, try to rephrase your question.