Splunk Search
Highlighted

Can you help me compare how much data was ingested in GB from an index today and yesterday?

Path Finder

I tried this,

| dbinspect index=test  | eval GB=sizeOnDiskMB/1024| addinfo span=-2d | stats sum(GB) as today 
| append
 [| dbinspect index=test  | eval GB=sizeOnDiskMB/1024 | addinfo span=-1d | stats sum(GB) as yesterday ]

I am not getting accurate results from above. Can any one suggest a query with accurate results?

Thanks.

0 Karma
Highlighted

Re: Can you help me compare how much data was ingested in GB from an index today and yesterday?

SplunkTrust
SplunkTrust

Use the license usage query (run this on your license server OR search head, if you forward license server logs to indexers searchable by search head). Use appropriate time range (e.g. earliest=-1d@d latest=now)

index=_internal sourcetype=splunkd component=LicenseUsage idx=test 
| timechart span=1d sum(b) as usage
| eval usageGB=round(usage/1024/1024/1024,2)
0 Karma
Highlighted

Re: Can you help me compare how much data was ingested in GB from an index today and yesterday?

Path Finder

@somesoni2 thanks, The query you mentioned gives license usage of index, I am looking to figure out how much data i am getting from all servers to that particular index(ex:test) and compare today's data to yesterday's data.

And can you please explain difference between

index=_internal sourcetype=splunkd component=LicenseUsage idx=test
| timechart span=1d sum(b) as usage
| eval usageGB=round(usage/1024/1024/1024,2)

And
| dbinspect index=test | eval GB=sizeOnDiskMB/1024 | stats sum(GB)

Thanks.

0 Karma