Splunk Search

Determining bytes scanned during a search?

Beaker77
Explorer

Hey there Splunkers!

Similar to the question "How is the Size value on the job page calculated and logged in Splunk?" how can I determine how much disk is scanned when a search is run?

I can get the event_count and scan_count from the search head logs, but are bytes scanned logged in a file anywhere, or do I have to use diskUsage in | rest splunk_server=local /services/search/jobs?

Gracias!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Beaker77,
what do you mean with "scanned"?
if you mean disk used for each search job one Splunk server you can use diskUsage.

Ciao.
Giuseppe

0 Karma

Beaker77
Explorer

Hey @gcusello - By scanned I mean the total number of bytes examined in a search (not necessarily the number of bytes returned in the results).

The docs say diskUsage is "The total amount of disk space used, in bytes." so I think that's the compressed size of the matching events returned from a search as stored on disk in the dispatch folder.

Thanks for chiming in 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Beaker77,
sincerely I don't know the total number of bytes examined and I don't know if it's possible to extract it.
It's possible to know the number of scanned events and you could calculate an average, but anyway why do you need to know this?

You can have the number of scanned events from Job Inspector or taking from job properties scan.count.
For more details see at https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/ViewsearchjobpropertieswiththeJobInspector .

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...