how to get the total each indexer volume size utilization in the indexer cluster of 10

[venugoski]

how to get the total each indexer volume size utilization in the indexer cluster of 10.
i have the cluster manager with 10 indexers and like to know is there a way to query from the CM or the dashboard view the volume utilization of each indexer.
we don't have the distribution monitoring console setup yet.
we have 1 SH cluster with 5 SH
1CM
10 indexers
1 deployer to manage SH cluster

[isoutamo]

Hi

you could found suitable SPL from MC's indexing -> Indexes and Volumes: Deployment dashboard.

Here it is without MC groups. This should work without MC configuration.

| rest  services/data/index-volumes splunk_server=<YOUR INDEXERS HERE with wildcard>
| eval _dmc_volume = if(isnotnull(title), title, 'data.name') 
| where NOT _dmc_volume == "_splunk_summaries" 
| fields - _dmc_volume 
| eval volumeSizeGB = if(total_size > 1, round(total_size / 1024, 2), null()) 
| eval sizeUsagePerc = total_size / max_size * 100 
| stats dc(splunk_server) as Instances count(eval(total_size > 1)) as "Non-Empty Instances" sum(volumeSizeGB) as totalSize avg(volumeSizeGB) as avgSize avg(sizeUsagePerc) as avgSizePerc perc90(sizeUsagePerc) as ninetyPercentileSizePerc count(eval(total_size > max_size)) as volumesFreezingDueToSize by title 
| eval totalSize = if(isnotnull(totalSize), totalSize, 0) 
| eval avgSize = if(isnotnull(avgSize), round(avgSize, 2), 0) 
| eval avgSizePerc = if(isnotnull(avgSizePerc), round(avgSizePerc, 2)."%", "N/A") 
| eval avgSizePerc = if(isnotnull(avgSizePerc), round(avgSizePerc, 2)."%", "N/A") 
| eval ninetyPercentileSizePerc = if(isnotnull(ninetyPercentileSizePerc), round(ninetyPercentileSizePerc, 2)."%", "N/A") 
| eval volumesFreezingDueToSize = if(avgSizePerc != "N/A", volumesFreezingDueToSize, "N/A") 
| rename title as "Volume" totalSize as "Total Size (GB)" avgSize as "Average Size (GB)" avgSizePerc as "Average Usage (%)" ninetyPercentileSizePerc as "90th Percentile Usage (%)" volumesFreezingDueToSize as "Volumes Freezing Due To Size"

I think that you could change this easily to match your actual needs?

r. Ismo