I have found ways to calculate total storage for all indexers per index. But how would I focus in on what is only occupying coldPath space? Possibly break this down per index.
thanks!
you can use the | dbinspect command
cold buckets are under state = cold.
then you can create searches calculating the total size by using sizeOnDiskMB field
so something like that:
| dbinspect index=* state = cold | eval indexSizeGB = sizeOnDiskMB / 1024 | stats sum(indexSizeGB) by index
Hope it helps
you can use the | dbinspect command
cold buckets are under state = cold.
then you can create searches calculating the total size by using sizeOnDiskMB field
so something like that:
| dbinspect index=* state = cold | eval indexSizeGB = sizeOnDiskMB / 1024 | stats sum(indexSizeGB) by index
Hope it helps
Thanks adonio
Had to expand on this a little hit. You can't filter on the state until the search is ran. I did the following
| dbinspect index=* | eval indexSizeGB = sizeOnDiskMB / 1024 | stats sum(indexSizeGB) as "Total Size in GBs" by index,state | search state=cold
Thanks pointing me in the right direction!
You are welcome!