Hello,
I am looking for a go-to search that will give me total number of buckets for an index for a specific state of a bucket and the total sizeOnDiskMB for this state. What would also be nice is if this could be at the bottom of a table for the index so I can see the location that all these buckets are stored. I can get the total of sizeOnDiskMB, but can't seem to add in the the total number of buckets as a row.
This is my current search
|dbinspect index=main state =warm splunk_server=*idx02* | eval size=sizeOnDiskMB/1024| addcoltotals | fillnull value="Total" | table index,path,size
any and all help would be great
You need to use an appendpipe
command, instead of addcoltotal which only does sum and only for numeric valued columns.
Give this a try
|dbinspect index=main state =warm splunk_server=*idx02* | eval size=sizeOnDiskMB/1024 | table index,path,size | appendpipe [| stats count(path) as path sum(size) as size | eval index="Total"]