Splunk Search

How to find the size of each of the data model in our environment via Splunk search or REST API?

rajkumargopagon
Explorer

I'm trying to estimate the storage used by all the data models in our environment. Is there a way to find the size of each of the data models using a Splunk search or a Rest call.

0 Karma
1 Solution

rajkumargopagon
Explorer

I was able to use the below query to show the size of all the datamodels which are accelerated.

|rest servicesNS/-/-/data/models
| search acceleration="1"
| table title eai:appName eai:userName
| rename eai:appName AS name| eval myDatamodel="DM_" . name . "_" . title
|map search="|rest /servicesNS/nobody/-/admin/summarization/tstats:$myDatamodel$ splunk_server=local"|table eai:acl.app,eai:acl.owner, summary.id, summary.size|rename eai:acl.app as app eai:acl.owner as owner summary.size as size summary.id as datamodel|eval sizeMB=round(size/1000000,2)|fields - size|addcoltotals sizeMB

View solution in original post

rajkumargopagon
Explorer

I was able to use the below query to show the size of all the datamodels which are accelerated.

|rest servicesNS/-/-/data/models
| search acceleration="1"
| table title eai:appName eai:userName
| rename eai:appName AS name| eval myDatamodel="DM_" . name . "_" . title
|map search="|rest /servicesNS/nobody/-/admin/summarization/tstats:$myDatamodel$ splunk_server=local"|table eai:acl.app,eai:acl.owner, summary.id, summary.size|rename eai:acl.app as app eai:acl.owner as owner summary.size as size summary.id as datamodel|eval sizeMB=round(size/1000000,2)|fields - size|addcoltotals sizeMB

View solution in original post

amirofmn
Explorer

Great search!

For anyone that tries to run it but gets a warning message about the search result count exceeding the maximum (10), include 'maxsearches= within the map command. Example would be:

| map search=" | rest /servicesNS/nobody/-/admin/summarization/tstats:$myDatamodel$ splunk_server=local" maxsearches=30

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!