Splunk Search

How to build a search to have a table with specific fields

Path Finder

Hi ,
I'm trying to have Splunk knowledge inventory.
Could you help me in building the search to have the table with the following fields:

Sourcetype , Fields , TA Used , Max Index size , Retention period , Ingestion Method(UF/HF) By Index.

So far, the search that I have built:

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype |join index [| rest  /services/data/indexes splunk_server="*" | fields title, frozenTimePeriodInSecs, maxTotalDataSizeMB, currentDBSizeMB totalEventCount  | eval frozenTimePeriodInSecs=(frozenTimePeriodInSecs/60/60/24)." days" | eval maxTotalDataSizeMB=tostring(maxTotalDataSizeMB/2014, "commas")." GB"  | rename maxTotalDataSizeMB AS "Max Index Size" frozenTimePeriodInSecs AS "Max Index Retention",  title AS index, currentDBSizeMB as Current_DB_Size(MB), totalEventCount as TotalEventCount] | stats values(sourcetype) AS sourcetype values(Max Index Size) as Max_Index_Size values(Max Index Retention) as Retention by index |mvexpand sourcetype

With this search I have got sourcetype , Index size , Retention Period and Max Index size.

Now I need help on getting remaining fields.

0 Karma

Path Finder

Missed index =* and sourcetype=* #updated search

| tstats count WHERE index=* OR sourcetype=* by index,sourcetype |join index [| rest /services/data/indexes splunkserver="*" | fields title, frozenTimePeriodInSecs, maxTotalDataSizeMB, currentDBSizeMB totalEventCount | eval frozenTimePeriodInSecs=(frozenTimePeriodInSecs/60/60/24)." days" | eval maxTotalDataSizeMB=tostring(maxTotalDataSizeMB/2014, "commas")." GB" | rename maxTotalDataSizeMB AS "Max Index Size" frozenTimePeriodInSecs AS "Max Index Retention", title AS index, currentDBSizeMB as CurrentDBSize(MB), totalEventCount as TotalEventCount] | stats values(sourcetype) AS sourcetype values(Max Index Size) as MaxIndex_Size values(Max Index Retention) as Retention by index |mvexpand sourcetype

0 Karma

SplunkTrust
SplunkTrust

what is your final output should look like? did you try and look at the Monitoring Console? seems like it has out of the box dashboards that fits your use case

0 Karma