Reporting

How to check log volume indexed per day in a particular index

iqbalintouch
Path Finder

Is there anyway to check how much log is being generated with DEBUG log mode for a particular index?

Let say if index name is my_index and I need to check what is size of log generated for DEBUG mode log

index=my_index DEBUG
@woodcock plz help 🙂

Labels (1)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
index=my_index TERM("DEBUG") 
| eval len=length(_raw)
| timechart span=1d sum(len) as len_byte
| eval GB=round(len_byte/1024/1024/1024,2)

how about this? @iqbalintouch 

View solution in original post

to4kawa
SplunkTrust
SplunkTrust

| tstats count where index=my_index TERM("DEBUG") by _time span=1d

@iqbalintouch how about this?

iqbalintouch
Path Finder

@to4kawa thank you for the response. I am getting the result but not sure if that is showing log size..if yes, is there way to convert in GB size?

iqbalintouch_0-1594843810795.png

 

Tags (1)
0 Karma

to4kawa
SplunkTrust
SplunkTrust

This query counts the events.
How much is  your one event size?

| eval GB=round(count * <your event size(byte)> / 1024 /1024 ,2)

try above.

0 Karma

iqbalintouch
Path Finder

Unfortunately, that I don't know how much data is being sent in a single event since we are seeing these events in REQUEST/RESPONSE which we send/receive from a third party. 😞

@to4kawa 

0 Karma

to4kawa
SplunkTrust
SplunkTrust
index=my_index TERM("DEBUG") 
| eval len=length(_raw)
| timechart span=1d sum(len) as len_byte
| eval GB=round(len_byte/1024/1024/1024,2)

how about this? @iqbalintouch 

View solution in original post

iqbalintouch
Path Finder

@to4kawa thank you, this is great help.
sorry for the late response, also could you please explain the query..how it is calculating 🙂

0 Karma

to4kawa
SplunkTrust
SplunkTrust

#1 search the text "DEBUG"
#2 calculate the event by length()(unit: byte)
#3 aggregate for bytes
#4 calculate by Giga Byte.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.