system app - what data is being stored in this index

[aengineer]

Hi,

Newbie splunk question. I have a Splunk server that is running out of disk space. Looking at all the indexes, I have a "system" app (name = "main") with the homepath of '$SPLUNK_DB/defaultdb/db ' that is occupying most of the space.

How can I find out what data is being stored in this index? That will help me decide if I need to reduce the max-size or add more space.

Thanks
Aspi

[micahkemp]

That's your default index, where events go when no other index was defined.

One way to characterize the type of data in it would be:

| tstats count WHERE index=main BY sourcetype

I'm sure there other methods of reporting to actually determine storage size per sourcetype/source/host/whatever, but this may give you a quick enough answer.