Splunk IT Service Intelligence

How to check my indexing volume exceeded and which server to get lots of data?

arulnight
Explorer

Hi All

How to check my indexing volume exceeded and try to find out which server getting lots of data?
can anyone help me out?

0 Karma

saramamurthy_sp
Splunk Employee
Splunk Employee

You must have a Monitoring console as it becomes handy and also to get the complete information about you enviornment.
You can monitor a lot of aspect of your enviornment. The dashoboard will give you the complete insight of your indexing performances.

The dash board will give you plenty of information about your indexes and volumes such as:

Disk usage by index

Volume usage

Index and volume size over time

Data age

Statistics for bucket types

Bucket settings

And viewing this dashboard will give you all the requred information. I would suggest you to read the below document.

DOC: https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Viewindexstatus

0 Karma

woodcock
Esteemed Legend

There are several views for this kind of thing on the Monitoring Console but if you don't have one or are not allowed on to it, you can try these:

| tstats count WHERE index=* BY host

And:

| tstats count WHERE index=* BY host _time span=1h | timechart span=1h sum(count) AS count BY host

And:

index=* | eval bytes=len(_raw) | stats sum(bytes) AS bytes BY host

And:

index=* | eval bytes=len(_raw) | timechart span=1 sum(bytes) AS bytes BY host
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!