Splunk Search

How to find the size of each of the data model in our environment via Splunk search or REST API?

rajkumargopagon
Explorer

I'm trying to estimate the storage used by all the data models in our environment. Is there a way to find the size of each of the data models using a Splunk search or a Rest call.

0 Karma
1 Solution

rajkumargopagon
Explorer

I was able to use the below query to show the size of all the datamodels which are accelerated.

|rest servicesNS/-/-/data/models
| search acceleration="1"
| table title eai:appName eai:userName
| rename eai:appName AS name| eval myDatamodel="DM_" . name . "_" . title
|map search="|rest /servicesNS/nobody/-/admin/summarization/tstats:$myDatamodel$ splunk_server=local"|table eai:acl.app,eai:acl.owner, summary.id, summary.size|rename eai:acl.app as app eai:acl.owner as owner summary.size as size summary.id as datamodel|eval sizeMB=round(size/1000000,2)|fields - size|addcoltotals sizeMB

View solution in original post

rajkumargopagon
Explorer

I was able to use the below query to show the size of all the datamodels which are accelerated.

|rest servicesNS/-/-/data/models
| search acceleration="1"
| table title eai:appName eai:userName
| rename eai:appName AS name| eval myDatamodel="DM_" . name . "_" . title
|map search="|rest /servicesNS/nobody/-/admin/summarization/tstats:$myDatamodel$ splunk_server=local"|table eai:acl.app,eai:acl.owner, summary.id, summary.size|rename eai:acl.app as app eai:acl.owner as owner summary.size as size summary.id as datamodel|eval sizeMB=round(size/1000000,2)|fields - size|addcoltotals sizeMB

amirofmn
Explorer

Great search!

For anyone that tries to run it but gets a warning message about the search result count exceeding the maximum (10), include 'maxsearches= within the map command. Example would be:

| map search=" | rest /servicesNS/nobody/-/admin/summarization/tstats:$myDatamodel$ splunk_server=local" maxsearches=30

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...