Details on indexes

[beepboop12]

Hello, I need certain details for my indexes. I have searched Splunk answers but have yet to find an answer that works for me.

Essentially, I need to find the average daily volume for my indexes in the last ~30 days. I also need to find out how the indexes are being used and by whom.

Any information would be greatly appreciated. Thank you for your help

[aljohnson_splun]

Daily Volume for Indexes

Check out S.o.S. (Splunk on Splunk) ! It's a free app.

`set_internal_index` host="some_host" source=*metrics.log group="per_index_thruput"
                | bin _time 
                | stats sum(kb) AS KB by series,_time
                | timechart minspan=30s  avg(eval(round(KB/1024/1024,2))) by series

You could then change sum (like the image) to avg (in the code above).

Index Access & Usage

It sounds like you want to explore the _internal index!

See this documentation for lots of information.

[martin_mueller]

Additionally, if you're on 6.2.x, check out the Distributed Management Console that ships since this version. It has many great base statistics you can work off from.

[knutsod]

For the index usage, use this search to get started:

index=_internal source="*metrics.log" group="per_index_thruput" | timechart span=1d sum(kb) by series