Splunk Search

How to calculate the index size from top 10 biggest indexers

myleskennison
Explorer

Sorry about this lame post. Our Splunk admin had to leave unexpectedly and now it's up to me to do this without any prior knowledge.  I'm trying to figure out how to make a dashboard that displays our biggest indexers out of about 100.  Management wants to know which indexes are ingesting the most data daily and how much.  

 

Any help would be appreciated.  Thank you

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @myleskennison,

In your question, there is confusion about indexes and indexers but I assume you need index sizes.

Please try below on your search head, it will show you total index sizes in megabytes and total event counts per index.

| rest /services/data/indexes 
| stats sum(currentDBSizeMB) as currentDBSizeMB sum(totalEventCount) as totalEventCount by title 
| rename title as index
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check the Monitoring Console.  Settings->Monitoring console->Indexing->Indexes and Volumes:Instance.

Other dashboards in the MC may help, too.

---
If this reply helps you, Karma would be appreciated.
0 Karma

myleskennison
Explorer

Thanks Rich but I don't have the monitoring console.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Everyone has the monitoring console.  It's built in to Splunk Enterprise.  The trick may be in finding the right instance where the MC is configured.

A good resource for someone taking over a Splunk deployment is the Inherit a Splunk Deployment manual at https://docs.splunk.com/Documentation/Splunk/8.2.2/InheritedDeployment/Introduction

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...