Splunk Search

Can you use tstats to get daily index or indexer volume?

Glasses
Contributor

Just wondering if its possible to get data volume / size from TSTATS.

I know you can do something like this to get counts (events/per sec)

| tstats count WHERE index=* by index| eval events_per_second=count/(3600*24)

but how can you use tstats for find volume of data per time?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

As far as I can tell, there is no indexed field that indicates data volume so you can't use tstats to get that value.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As far as I can tell, there is no indexed field that indicates data volume so you can't use tstats to get that value.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Glasses
Contributor

thank you for confirming, I could not find a list of tstats fields.... is there a doc for tstat fields?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no documentation for tstats fields because the list of fields is not fixed. It depends on which fields you choose to extract at index time. You can, however, use the walklex command to find such a list.

walklex type=term index=foo 
---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!