Splunk Search

Determining bytes scanned during a search?

Beaker77
Explorer

Hey there Splunkers!

Similar to the question "How is the Size value on the job page calculated and logged in Splunk?" how can I determine how much disk is scanned when a search is run?

I can get the event_count and scan_count from the search head logs, but are bytes scanned logged in a file anywhere, or do I have to use diskUsage in | rest splunk_server=local /services/search/jobs?

Gracias!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Beaker77,
what do you mean with "scanned"?
if you mean disk used for each search job one Splunk server you can use diskUsage.

Ciao.
Giuseppe

0 Karma

Beaker77
Explorer

Hey @gcusello - By scanned I mean the total number of bytes examined in a search (not necessarily the number of bytes returned in the results).

The docs say diskUsage is "The total amount of disk space used, in bytes." so I think that's the compressed size of the matching events returned from a search as stored on disk in the dispatch folder.

Thanks for chiming in 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Beaker77,
sincerely I don't know the total number of bytes examined and I don't know if it's possible to extract it.
It's possible to know the number of scanned events and you could calculate an average, but anyway why do you need to know this?

You can have the number of scanned events from Job Inspector or taking from job properties scan.count.
For more details see at https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/ViewsearchjobpropertieswiththeJobInspector .

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...