Splunk Search

Creating an alert for daily indexed volume for 4.2.x

Path Finder


I want to create a saved search that will send an email with a report on daily index volumes to know when I'm close to a license violation.

I've looked at the documentation but the search given no longer works in 4.2 (and can't track the new fields yet. I'm aware of the deployment app, but I need something that will send out an email alert to a distribution list to send early warnings.

Do you have a search query available? Or know which fields in the _internal index I can use?


0 Karma
1 Solution

Splunk Employee
Splunk Employee

Ultra Champion

The following search seem to work much faster, and the results are close enough - there may be some small rounding effects, but nothing significant. It's based on the searches used by the Deployment Monitor. It does not take the advanced licensing stacking, pooling etc into account. It will just give you a simple table of the amount indexed by indexer.

I did put a "where" statement in to filter out the search head itself, which also poplulates the summary index, but it's only a couple of kb, so it just clutters the report (the poster said he wanted an early warning system - not correctness down to the *n*th decimal).

index="summary_indexers" |  bucket _time as day span=d | eval gb=kb/1048576 | eval Date = strftime(day, "%b %d, %Y - %A")| stats sum(gb) as GB by my_splunk_server, Date | eval GB=round(GB,2)| where GB > "0.01" |eventstats sum(GB) as SumDailyGB by Date

This has been tested on a 1 search head - 1 indexer setup, so your results may differ.

Not sure if this would really help you, but you could always play around with it a little. Below a simpler version just giving you the basics.

index="summary_indexers" | eval GB=kb/1048576 | eval GB=round(GB,2)| timechart span=1d sum(GB) by my_splunk_server | addtotals 


0 Karma

Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...