How can we figure out the size of KVStores and Lookups?

[davedubinsky]

In our enterprise sometimes kvstores and lookup files can get really large and we're looking for a way to monitor this. I don't see anything in _internal that would show me the size of each kvstore. What I'd like to be able to do is run a query each day and then graph (or table) the results by kvstore name and size. Anyone out there have an idea on how to accomplish this.

[woodcock]

Please see my answer over here (don't forget to UpVote😞
https://answers.splunk.com/answers/701881/is-there-a-search-to-show-bundle-size-in-the-dispa.html

[gwalford]

If you are using Linux, this bash one-liner will give you a list of all the lookups on a search head in a shared bundle:

find /opt/splunk/var/run -maxdepth 1 -name '*.bundle'  -print -exec tar -tvf {} \; | grep users |  awk '{print $3,$6}' | sort -nr

In the case above, you may want to remove the "grep users" segment, I created it as it is to search for users that were creating files that were abnormally large.

[MousumiChowdhur]

Hi!

You can try writing a script and index the output of the script in Splunk. The script would basically got the desired location then do ls -lrt and print the output.
With this indexed data, you can build dashboards which will show the lookup/kv store name, time and the size.

Thanks.

[davedubinsky]

yep, thanks. that's my backup plan. was hoping these data were in the _internal index or somewhere where I could write a query to pull it back vs. a script.