Splunk Search

Charting Total Index Size vs Used Space Inside Index

aferone
Builder

Hello to all,

We have a few indexes that are configured with different max MB's. I want to be able to create a dashboard that shows pie charts of each index that shows total size of the index vs how much actual data is in each index.

I have no problems hard-coding the total values, but how do I get how many MB are being used in each index?

And for another elementary question, how I chart the total value vs the used value?

Thanks for the help!

Alex

Tags (1)
0 Karma

paul_1994
Path Finder

Updated Links for the links above

Here in the docs

Visualization the docs

The Visualization link may not be the same thing.. It seems the chart gallery is missing.

0 Karma

melting
Splunk Employee
Splunk Employee

To get the index sizes you can use this search

 | eventcount summarize=false report_size=true index=* | eval MB = size_bytes / 1024 / 1024

To get the max index size, perhaps you could make a CSV and use it as a lookup: Here in the docs

Finally how to chart? Perhaps take a look at the Visualization the docs But to help start by making a table lik e this:

 ... | table index MB total_MB

sdewar83
Path Finder

This doesnt seem to work? I tried the eventcount command... what it shows in MB as the size of my indexes is less than what it shows when i navigate to the index folder on the server and less than what it shows in Settings > indexes. Settings > Indexes and the actual folder sizes on disk match up.

0 Karma
Get Updates on the Splunk Community!

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...