Gather size of an index across multiple indexers?

[kwaingrow]

We are set up with a single searcher and multiple indexers. We have an unique 500,000 MB index named "website" created on multiple indexers. From a savedsearch on the searcher, is there way to gather the current size of all the "website" indexes across all indexers and display the actual total current size?

If not is there a query command that will extract it that I can run as a savedsearch on each indexers?

Any help is greatly appreciated.

[Chubbybunny]

try:

 |eventcount summarize=false report_size=true index=website |  eval MB = size_bytes / 1024 / 1024

-Or, for all indexes-

|eventcount summarize=false report_size=true index=* |  eval MB = size_bytes / 1024 / 1024

!!props to Julian

[s2_splunk]

You may also want to take a look at the FireBrigade App on Splunkbase for many more details about your indexes. Note that there is a TA as well as the UI part (i.e. two apps to install).

[mendesjo]

found SOS app provides all of this data nicely..

[mendesjo]

That provides size for each individual indexer, but doesnt' give you a tally from all indexers.