Splunk Cloud Platform

index size per month

Strangertinz
Path Finder

Hi, 

Anyone know a summary index used by Splunk to retain the index sizes? I can calculate a index size by using internal index but I need to go back further than the last month. 

Any other method is welcomed as well. 

Thanks  

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Apart from finding the information (the _internal index by default rolls after 30 days), the trouble with "index sizes" is that there are so many different parameters which can be meant as "index size".

Even simple dbinspect has two different parameters (rawSize and sizeOnDiskMB). Add to this summary and datamodel_summary directories...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try the summary index and look for either source=splunk-storage-detail or source=splunk-storage-summary, depending on what you are looking for.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Strangertinz
Path Finder

Thanks @richgalloway 

I was able to see some data using the source mentioned below. However the "rawSizeBytes" field does not match the index size when converted to GB. 

  source=splunk-storage-detail 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...