Splunk Search

Charting Total Index Size vs Used Space Inside Index

aferone
Builder

Hello to all,

We have a few indexes that are configured with different max MB's. I want to be able to create a dashboard that shows pie charts of each index that shows total size of the index vs how much actual data is in each index.

I have no problems hard-coding the total values, but how do I get how many MB are being used in each index?

And for another elementary question, how I chart the total value vs the used value?

Thanks for the help!

Alex

Tags (1)
0 Karma

paul_1994
Path Finder

Updated Links for the links above

Here in the docs

Visualization the docs

The Visualization link may not be the same thing.. It seems the chart gallery is missing.

0 Karma

melting
Splunk Employee
Splunk Employee

To get the index sizes you can use this search

 | eventcount summarize=false report_size=true index=* | eval MB = size_bytes / 1024 / 1024

To get the max index size, perhaps you could make a CSV and use it as a lookup: Here in the docs

Finally how to chart? Perhaps take a look at the Visualization the docs But to help start by making a table lik e this:

 ... | table index MB total_MB

sdewar83
Path Finder

This doesnt seem to work? I tried the eventcount command... what it shows in MB as the size of my indexes is less than what it shows when i navigate to the index folder on the server and less than what it shows in Settings > indexes. Settings > Indexes and the actual folder sizes on disk match up.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...