Splunk Search

Comparing index sizes on 2 dates

tsheets13
Communicator

I have been asked to create an alert that looks at the index sizes (all indexes) for today, and compare them to the sizes as they were one week ago. I know I can get the index sizes for the last 7 days with

 index=_introspection component=Indexes | eval data.total_size = 'data.total_size' / 1024 | timechart span=1d max("data.total_size") by data.name

However, how can I compare the sizes of each index, 1 by 1, between today and 7 days ago.

Thanks for the help.

Labels (2)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Hi @tsheets13,

Try this:

index=_introspection component=Indexes earliest=-1d@d latest=@d 
| eval field="today" 
| append 
    [ search index=_introspection component=Indexes earliest=-8d@d latest=-7d@d 
    | eval field="sevendaysago"] 
| eval total_size = 'data.total_size'/1024 
| stats max(total_size) as total_size by data.name, field 
| xyseries data.name field total_size 
| where today > sevendaysago

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Hi @tsheets13,

Try this:

index=_introspection component=Indexes earliest=-1d@d latest=@d 
| eval field="today" 
| append 
    [ search index=_introspection component=Indexes earliest=-8d@d latest=-7d@d 
    | eval field="sevendaysago"] 
| eval total_size = 'data.total_size'/1024 
| stats max(total_size) as total_size by data.name, field 
| xyseries data.name field total_size 
| where today > sevendaysago
0 Karma

tsheets13
Communicator

That's perfect. I am not sure why you singled out indexes with the name of device and syslogs, but after I removed that, I got what I want. Now if you don't mind helping me take it just a step further. I need to alert if the difference between today and sevendaysago are greater than 20% on any given index and report that index and difference. Thanks

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

I was checking this query on test data on my machine. You can calculate difference and check if it is greater than 20% of index size 7 days ago. Check this.

index=_introspection component=Indexes earliest=-1d@d latest=@d 
| eval field="today" 
| append 
    [ search index=_introspection component=Indexes earliest=-8d@d latest=-7d@d 
    | eval field="sevendaysago"] 
| eval total_size = 'data.total_size'/1024 
| stats max(total_size) as total_size by data.name, field 
| xyseries data.name field total_size 
| eval difference = today - sevendaysago 
| where difference > sevendaysago*20/100

Please accept and upvote answer if this helps you:)

0 Karma

tsheets13
Communicator

exactly what I needed, thank you!

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

you're welcome.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...