Detailed Index Status Report - Is there one?

[lguinn2]

I would like to see the following for each index

• limit (maximum size) Mb
• current size Mb

• avg. Mb indexed per day last 30 days

• for hot, warm, cold:

  • # buckets
  • earliest, latest date (across all buckets in category)
  • current size Mb

Some of this information can be seen in current reports, but not all in one place. Other data, like the breakout by hot, warm, and cold categories, does not seem to appear anywhere in the Status selections.

Does this report, or anything like it, exist?

[lguinn2]

Before you go too far in building your own reports, check out the Distributed Management Console.

In each release of Splunk, the DMC has gotten stronger. You can now set alerts for a variety of conditions on your indexers, including low disk space.

[sherm77]

Here's a search that I've been using, I leave out guid & id, since I don't have index replication yet & the id is in the bucketId. I've converted the start & end epoch times (since I don't read them fluently yet) and converted the raw size & ondisk (indexed) sizes to field names I like. This will show all of your indexes configured, including _* indexes. Also, I've sorted by the state, since I wanted to see the hot buckets first. You could easily sort on the index name & state, etc.

| dbinspect index=*|eval rawsizeMB=round(rawSize/1024/1024,2)| eval indexedsizeMB=round(sizeOnDiskMB,2)|convert timeformat="%Y-%m-%d %H:%M:%S" ctime(endEpoch) AS end_time| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(startEpoch) AS start_time| table bucketId start_time end_time state eventCount hostCount modTime path rawsizeMB indexedsizeMB sourceCount sourceTypeCount | sort state

This works on Splunk version 6.2.0.

[lguinn2]

Here is a revision of the answer above. This will work with Splunk 6.x

| dbinspect
| rename state as category 
| stats min(startEpoch) as earliestTime max(endEpoch) as latestTime sum(sizeOnDiskMB) as MB by index category 
| convert timeformat="%m/%d/%Y" ctime(earliestTime) as earliestTime ctime(latestTime) as latestTime

[tpaulsen]

If you´ve build one, maybe you can share. I would like to have something like this as well, or at least get the idea how to do it.

[sideview · Accepted solution]

Well indeed it would be awesome if we had a more detailed view, or if drilldown interaction from the status view took you to a richer detail view about a particular category/bucket/index etc..

But in the meantime, I can answer some of these at the search language level.

1) the question about seeing stats for the hot vs warm and cold buckets.
This search will do it. (I kinda like your convention of breaking it up by command so I'll follow it)

| dbinspect timeformat="%s" 
| rename state as category 
| stats min(earliestTime) as earliestTime max(latestTime) as latestTime sum(sizeOnDiskMB) as MB by category 
| convert timeformat="%m/%d/%Y" ctime(earliestTime) as earliestTime ctime(latestTime) as latestTime

You can use a different timeformat obviously, but that'll give you a table that looks like:

category    earliestTime     latestTime     MB
hot         04/21/2010       04/24/2010     2033.864350
warm        02/18/2010       04/22/2010     8033.864350
...

2) the sum in MB per index, for each day in the last 30 days:

if you want to eventually chart it in a FlashChart, use chart:

index=_internal source=*metrics.log group=per_index_thruput 
| eval MB=kb/1024 
| timechart span=1d sum(MB) by series 
| fields - VALUE_*

If on the other hand you want to end up with a table where each row is a unique combination of a day plus an index, you'd take away the timechart and use a bin command and a stats command instead.

3) as for the actual current size on disk of each index, i dont know of a way but its very possible that someone else does.
I do know that in the output of the dbinspect command, one could tease out the 'defaultdb' part of the 'path' field, and then do a chart/stats/timechart split by that field and that could sum up the sizeOnDiskMB field quite easily...

[Simeon]

This kind of report does not currently exist as far as I know.

You will likely need to use a combination of searches against the internal index and metadata to create a report which tells you all of this information.