Splunk Search

How to build a search to have a table with specific fields

NAVEEN_CTS
Path Finder

Hi ,
I'm trying to have Splunk knowledge inventory.
Could you help me in building the search to have the table with the following fields:

Sourcetype , Fields , TA Used , Max Index size , Retention period , Ingestion Method(UF/HF) By Index.

So far, the search that I have built:

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype |join index [| rest  /services/data/indexes splunk_server="*" | fields title, frozenTimePeriodInSecs, maxTotalDataSizeMB, currentDBSizeMB totalEventCount  | eval frozenTimePeriodInSecs=(frozenTimePeriodInSecs/60/60/24)." days" | eval maxTotalDataSizeMB=tostring(maxTotalDataSizeMB/2014, "commas")." GB"  | rename maxTotalDataSizeMB AS "Max Index Size" frozenTimePeriodInSecs AS "Max Index Retention",  title AS index, currentDBSizeMB as Current_DB_Size(MB), totalEventCount as TotalEventCount] | stats values(sourcetype) AS sourcetype values(Max Index Size) as Max_Index_Size values(Max Index Retention) as Retention by index |mvexpand sourcetype

With this search I have got sourcetype , Index size , Retention Period and Max Index size.

Now I need help on getting remaining fields.

0 Karma

NAVEEN_CTS
Path Finder

Missed index =* and sourcetype=* #updated search

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype |join index [| rest /services/data/indexes splunk_server="*" | fields title, frozenTimePeriodInSecs, maxTotalDataSizeMB, currentDBSizeMB totalEventCount | eval frozenTimePeriodInSecs=(frozenTimePeriodInSecs/60/60/24)." days" | eval maxTotalDataSizeMB=tostring(maxTotalDataSizeMB/2014, "commas")." GB" | rename maxTotalDataSizeMB AS "Max Index Size" frozenTimePeriodInSecs AS "Max Index Retention", title AS index, currentDBSizeMB as Current_DB_Size(MB), totalEventCount as TotalEventCount] | stats values(sourcetype) AS sourcetype values(Max Index Size) as Max_Index_Size values(Max Index Retention) as Retention by index |mvexpand sourcetype

0 Karma

adonio
Ultra Champion

what is your final output should look like? did you try and look at the Monitoring Console? seems like it has out of the box dashboards that fits your use case

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...