Splunk Search

Can the Splunk OS TAs capture time?


Apparently, the Splunk OS TAs don't capture time and if there are index time delays, _time would be skewed and actually be _indextime.

For example, the output of df.sh is -

Filesystem                                          Type              Size        Used       Avail      UsePct    MountedOn
/                                                   xxx               50G         18G         30G         37%    /
/yyyyy                                              xxx              600G        401G        186G         69%    /yyyyy
/zzzzz                                              xxx               50G         18G         30G         37%    /zzzzz

Is there anything we can do about it?

Tags (4)
0 Karma


Hello @danielbb,

I think TA_nix developers did it intentionally - the disk usage dosn't change rapidly and any change will not be apparent because of using the human readable format anyway - the usage is rounded to GB.

But it is easy to change by modifing df.sh (prepend with date command) and adjusting props.conf on the indexer side.

For a real time statistic it is better to use sysstat, particularly

sar -F 1 /dev/sda1


sar -F 1
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...