Splunk Search

Can you use tstats to get daily index or indexer volume?

Glasses
Builder

Just wondering if its possible to get data volume / size from TSTATS.

I know you can do something like this to get counts (events/per sec)

| tstats count WHERE index=* by index| eval events_per_second=count/(3600*24)

but how can you use tstats for find volume of data per time?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

As far as I can tell, there is no indexed field that indicates data volume so you can't use tstats to get that value.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As far as I can tell, there is no indexed field that indicates data volume so you can't use tstats to get that value.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Glasses
Builder

thank you for confirming, I could not find a list of tstats fields.... is there a doc for tstat fields?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no documentation for tstats fields because the list of fields is not fixed. It depends on which fields you choose to extract at index time. You can, however, use the walklex command to find such a list.

walklex type=term index=foo 
---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>