Splunk Search
Highlighted

How can we figure out the size of KVStores and Lookups?

Engager

In our enterprise sometimes kvstores and lookup files can get really large and we're looking for a way to monitor this. I don't see anything in _internal that would show me the size of each kvstore. What I'd like to be able to do is run a query each day and then graph (or table) the results by kvstore name and size. Anyone out there have an idea on how to accomplish this.

Highlighted

Re: How can we figure out the size of KVStores and Lookups?

Contributor

Hi!

You can try writing a script and index the output of the script in Splunk. The script would basically got the desired location then do ls -lrt and print the output.
With this indexed data, you can build dashboards which will show the lookup/kv store name, time and the size.

Thanks.

Highlighted

Re: How can we figure out the size of KVStores and Lookups?

Engager

yep, thanks. that's my backup plan. was hoping these data were in the _internal index or somewhere where I could write a query to pull it back vs. a script.

0 Karma
Highlighted

Re: How can we figure out the size of KVStores and Lookups?

Path Finder

If you are using Linux, this bash one-liner will give you a list of all the lookups on a search head in a shared bundle:

find /opt/splunk/var/run -maxdepth 1 -name '*.bundle'  -print -exec tar -tvf {} \; | grep users |  awk '{print $3,$6}' | sort -nr

In the case above, you may want to remove the "grep users" segment, I created it as it is to search for users that were creating files that were abnormally large.

0 Karma
Highlighted

Re: How can we figure out the size of KVStores and Lookups?

Esteemed Legend