Splunk Search

How to build a search to have a table with specific fields

NAVEEN_CTS
Path Finder

Hi ,
I'm trying to have Splunk knowledge inventory.
Could you help me in building the search to have the table with the following fields:

Sourcetype , Fields , TA Used , Max Index size , Retention period , Ingestion Method(UF/HF) By Index.

So far, the search that I have built:

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype |join index [| rest  /services/data/indexes splunk_server="*" | fields title, frozenTimePeriodInSecs, maxTotalDataSizeMB, currentDBSizeMB totalEventCount  | eval frozenTimePeriodInSecs=(frozenTimePeriodInSecs/60/60/24)." days" | eval maxTotalDataSizeMB=tostring(maxTotalDataSizeMB/2014, "commas")." GB"  | rename maxTotalDataSizeMB AS "Max Index Size" frozenTimePeriodInSecs AS "Max Index Retention",  title AS index, currentDBSizeMB as Current_DB_Size(MB), totalEventCount as TotalEventCount] | stats values(sourcetype) AS sourcetype values(Max Index Size) as Max_Index_Size values(Max Index Retention) as Retention by index |mvexpand sourcetype

With this search I have got sourcetype , Index size , Retention Period and Max Index size.

Now I need help on getting remaining fields.

0 Karma

NAVEEN_CTS
Path Finder

Missed index =* and sourcetype=* #updated search

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype |join index [| rest /services/data/indexes splunk_server="*" | fields title, frozenTimePeriodInSecs, maxTotalDataSizeMB, currentDBSizeMB totalEventCount | eval frozenTimePeriodInSecs=(frozenTimePeriodInSecs/60/60/24)." days" | eval maxTotalDataSizeMB=tostring(maxTotalDataSizeMB/2014, "commas")." GB" | rename maxTotalDataSizeMB AS "Max Index Size" frozenTimePeriodInSecs AS "Max Index Retention", title AS index, currentDBSizeMB as Current_DB_Size(MB), totalEventCount as TotalEventCount] | stats values(sourcetype) AS sourcetype values(Max Index Size) as Max_Index_Size values(Max Index Retention) as Retention by index |mvexpand sourcetype

0 Karma

adonio
Ultra Champion

what is your final output should look like? did you try and look at the Monitoring Console? seems like it has out of the box dashboards that fits your use case

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...