Splunk Search

Charting Total Index Size vs Used Space Inside Index

aferone
Builder

Hello to all,

We have a few indexes that are configured with different max MB's. I want to be able to create a dashboard that shows pie charts of each index that shows total size of the index vs how much actual data is in each index.

I have no problems hard-coding the total values, but how do I get how many MB are being used in each index?

And for another elementary question, how I chart the total value vs the used value?

Thanks for the help!

Alex

Tags (1)
0 Karma

paul_1994
Path Finder

Updated Links for the links above

Here in the docs

Visualization the docs

The Visualization link may not be the same thing.. It seems the chart gallery is missing.

0 Karma

melting
Splunk Employee
Splunk Employee

To get the index sizes you can use this search

 | eventcount summarize=false report_size=true index=* | eval MB = size_bytes / 1024 / 1024

To get the max index size, perhaps you could make a CSV and use it as a lookup: Here in the docs

Finally how to chart? Perhaps take a look at the Visualization the docs But to help start by making a table lik e this:

 ... | table index MB total_MB

sdewar83
Path Finder

This doesnt seem to work? I tried the eventcount command... what it shows in MB as the size of my indexes is less than what it shows when i navigate to the index folder on the server and less than what it shows in Settings > indexes. Settings > Indexes and the actual folder sizes on disk match up.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...