Splunk Enterprise

Gather size of an index across multiple indexers?

kwaingrow
Path Finder

We are set up with a single searcher and multiple indexers. We have an unique 500,000 MB index named "website" created on multiple indexers. From a savedsearch on the searcher, is there way to gather the current size of all the "website" indexes across all indexers and display the actual total current size?

If not is there a query command that will extract it that I can run as a savedsearch on each indexers?

Any help is greatly appreciated.

Tags (1)

Chubbybunny
Splunk Employee
Splunk Employee

try:

 |eventcount summarize=false report_size=true index=website |  eval MB = size_bytes / 1024 / 1024

-Or, for all indexes-

|eventcount summarize=false report_size=true index=* |  eval MB = size_bytes / 1024 / 1024

!!props to Julian

s2_splunk
Splunk Employee
Splunk Employee

You may also want to take a look at the FireBrigade App on Splunkbase for many more details about your indexes. Note that there is a TA as well as the UI part (i.e. two apps to install).

0 Karma

mendesjo
Path Finder

found SOS app provides all of this data nicely..

0 Karma

mendesjo
Path Finder

That provides size for each individual indexer, but doesnt' give you a tally from all indexers.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>